Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Modelarmor Sanitize Prompt Skill Security Audit

What the author says it does (original text)

Google Model Armor: Sanitize a user prompt through a Model Armor template.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Prompts or full JSON bodies may be submitted to the selected Model Armor resource

Source references: 4
What we found

The command gives `--text`, `--json`, or standard input to a Model Armor resource identified by project, location, and template. The supplied material does not state retention, logging, region, or which identity receives access.

Why this matters

If the input contains secrets, personal data, internal instructions, or customer content, that data may enter the configured Google service project and its logging or governance boundary.

When the command is run with `--text`, `--json`, or stdin, that content is processed by the Model Armor template named by `--template`. Confidential, personal, or account data could therefore be exposed to that Google Cloud resource and its logging or retention controls; the supplied source does not specify region, retention, or who can access it. Before sending sensitive input, the user can require those details and restrict the permitted template project and input types.

SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--template` | ✓ | — | Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE) || `--text` | — | — | Text content to sanitize || `--json` | — | — | Full JSON request body (overrides --text) |
Show 3 other places
SKILL.md:37In the instructionsOpen original file
```bashgws modelarmor +sanitize-prompt --template projects/P/locations/L/templates/T --text 'user input'echo 'prompt' | gws modelarmor +sanitize-prompt --template ...```
SKILL.md:43In the instructionsOpen original file
- If neither --text nor --json is given, reads from stdin.- For outbound safety, use +sanitize-response instead.
SKILL.md:23In the instructionsOpen original file
```bashgws modelarmor +sanitize-prompt --template <NAME>```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

The Skill directs users to run a generator when a shared prerequisite file is absent

Source references: 1
What we found

The setup instruction requires another Skill in the parent directory and says to run `gws generate-skills` to create it if absent. This is a persistent file-generation step beyond prompt sanitization, and the supplied material does not show which files the command creates or overwrites.

Why this matters

Running it may add or update files in the Skill hierarchy and introduce authentication or security instructions that were not included in this audit. The evidence does not establish whether existing files are overwritten.

What this evidence establishes

This is an active prerequisite: if the shared Skill is missing, it directs the agent to run a generation command, so file writes are possible. However, the supplied source only says it creates the shared file and does not show the implementation, output scope, or overwrite behavior of `gws generate-skills`; modification of other existing files cannot be confirmed. Before running it, the user can request exact output paths, overwrite rules, and required permissions, or test it in an isolated directory.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This Skill invokes `gws modelarmor +sanitize-prompt` and uses a specified full Model Armor template resource name to process text, a JSON request body, or standard input.

View source
SKILL.md:23In the instructionsOpen original file
```bashgws modelarmor +sanitize-prompt --template <NAME>```
SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--template` | ✓ | — | Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE) || `--text` | — | — | Text content to sanitize || `--json` | — | — | Full JSON request body (overrides --text) |
SKILL.md:43In the instructionsOpen original file
- If neither --text nor --json is given, reads from stdin.- For outbound safety, use +sanitize-response instead.

The Skill describes inbound sanitization of user prompts only. It explicitly says outbound content requires a different command, so this workflow does not itself sanitize model responses.

View source
SKILL.md:18In the instructionsOpen original file
Sanitize a user prompt through a Model Armor template
SKILL.md:44In the instructionsOpen original file
- If neither --text nor --json is given, reads from stdin.- For outbound safety, use +sanitize-response instead.
Start here · InstructionsSKILL.md
gws-modelarmor-sanitize-prompt
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws modelarmor +sanitize-prompt --template <NAME>
SKILL.md:36In the instructionsOpen original file
```bashgws modelarmor +sanitize-prompt --template projects/P/locations/L/templates/T --text 'user input'
Lines read
50
File checksum (to compare versions)
9979d657a53503363d67968168dc26b5c9c4345471090af41b87591d977e1969