Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Modelarmor Create Template Skill Security Audit

What the author says it does (original text)

Google Model Armor: Create a new Model Armor template.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

A missing shared dependency triggers a generator with undocumented file scope

Source references: 2
What we found

The prerequisite says to run `gws generate-skills` when the adjacent shared Skill is missing, but the supplied source does not identify which files that command creates or updates, nor require confirmation for this generation step.

Why this matters

An agent may make persistent local Skill-file changes even though the immediate task is to create a cloud template. The available evidence does not establish the target scope or whether existing content can be overwritten.

If the adjacent shared Skill is missing, the prerequisite explicitly directs the agent to run `gws generate-skills`. The supplied source does not identify which files it creates or updates, and the only confirmation warning is presented for the template-creation command. This supports a potential file-change risk, but not that execution occurred. A user can require a list of generated paths and overwrite rules, plus a preview and approval before execution.

SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Show 1 other places
SKILL.md:48In the instructionsOpen original file
> [!CAUTION]> This is a **write** command — confirm with the user before executing.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Omitting configuration silently selects the jailbreak preset

Source references: 3
What we found

Both `--preset` and `--json` are optional, while the documentation says omission of both defaults to the jailbreak preset. A user could approve template creation without explicitly approving the resulting security configuration.

Why this matters

The created security template may not cover the filtering scope the user expects. The supplied source does not explain which protections the jailbreak preset includes or excludes.

The source marks both `--preset` and `--json` as optional and states that omitting both selects the jailbreak preset. Thus, if a user approves only template creation without choosing configuration, the created content may be determined by this default. The documentation does disclose the default and requires confirmation before the write, so “silent” is not fully accurate; however, confirmation does not explicitly require showing the resolved configuration. A user can require the final preset or JSON to be displayed and approved first.

SKILL.md:33In the instructionsOpen original file
| `--template-id` | ✓ | — | Template ID to create || `--preset` | — | — | Use a preset template: jailbreak || `--json` | — | — | JSON body for the template configuration (overrides --preset) |
Show 2 other places
SKILL.md:45In the instructionsOpen original file
- Defaults to the jailbreak preset if neither --preset nor --json is given.- Use the resulting template name with +sanitize-prompt and +sanitize-response.
SKILL.md:48In the instructionsOpen original file
> [!CAUTION]> This is a **write** command — confirm with the user before executing.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The Skill’s primary operation creates a Model Armor template in a specified GCP project and location, requiring a project, location, and template ID.

View source
SKILL.md:18In the instructionsOpen original file
Create a new Model Armor template
SKILL.md:23In the instructionsOpen original file
```bashgws modelarmor +create-template --project <PROJECT> --location <LOCATION> --template-id <ID>```

The documentation explicitly identifies template creation as a write operation and requires user confirmation before execution.

View source
SKILL.md:48In the instructionsOpen original file
> [!CAUTION]> This is a **write** command — confirm with the user before executing.

Template configuration can come from the jailbreak preset or JSON; when both are supplied, JSON overrides the preset.

View source
SKILL.md:33In the instructionsOpen original file
| `--template-id` | ✓ | — | Template ID to create || `--preset` | — | — | Use a preset template: jailbreak || `--json` | — | — | JSON body for the template configuration (overrides --preset) |
Start here · InstructionsSKILL.md
gws-modelarmor-create-template
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws modelarmor +create-template --project <PROJECT> --location <LOCATION> --template-id <ID>
SKILL.md:38In the instructionsOpen original file
```bashgws modelarmor +create-template --project P --location us-central1 --template-id my-tmpl --preset jailbreak
Lines read
55
File checksum (to compare versions)
1295c62352dbdff92596d3bc5b0b648b72c52da0030b7c3d115e48e19d3e1e64