Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Keep Skill Security Audit

What the author says it does (original text)

Manage Google Keep notes.

Independent security check

No obvious risks found in this check

Files checked
1
Risks found
0
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

2 instruction sections

This Skill is a command-line guide for Google Keep, directing the agent to invoke resource methods through `gws keep <resource> <method> [flags]`; no script that automatically executes commands is shown.

View source
SKILL.md:18In the instructionsOpen original file
```bashgws keep <resource> <method> [flags]```

Before calling an API, the Skill requires inspecting command help and the selected method’s schema, then using that output to construct parameters and JSON request bodies.

View source
SKILL.md:38In the instructionsOpen original file
Before calling any API method, inspect it:```bash# Browse resources and methodsgws keep --help# Inspect a method's required params, types, and defaultsgws schema keep.<resource>.<method>```Use `gws schema` output to build your `--params` and `--json` flags.

Authentication, global flags, and security rules are delegated to a neighboring Skill that is not included in the supplied material; if absent, this Skill instructs the agent to run a generation command. The provided source therefore does not permit review of authentication handling or generated content.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.

The Skill exposes creation, retrieval, listing, download, and permission-related operations, and explicitly states that deleting a note is immediate, irreversible, and removes collaborator access.

View source
SKILL.md:26In the instructionsOpen original file
  - `download` — Gets an attachment. To download attachment media via REST requires the alt=media query parameter. Returns a 400 bad request error if attachment media is not available in the requested MIME type.### notes  - `create` — Creates a new note.  - `delete` — Deletes a note. Caller must have the `OWNER` role on the note to delete. Deleting a note removes the resource immediately and cannot be undone. Any collaborators will lose access to the note.  - `get` — Gets a note.  - `list` — Lists notes. Every list call returns a page of results with `page_size` as the upper bound of returned items. A `page_size` of zero allows the server to choose the upper bound. The ListNotesResponse contains at most `page_size` entries. If there are more things left to list, it provides a `next_page_token` value. (Page tokens are opaque values.) To get the next page of results, copy the result's `next_page_token` into the next request's `page_token`.  - `permissions` — Operations on the 'permissions' resource
Start here · InstructionsSKILL.md
gws-keep
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:18In the instructionsOpen original file
```bashgws keep <resource> <method> [flags]
SKILL.md:40In the instructionsOpen original file
```bash# Browse resources and methods
Lines read
50
File checksum (to compare versions)
8336c2641c3bf3b3852fcc8b8b37421bab58966236f8bef974a1d74a50b33936