Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Modelarmor Sanitize Response Skill Security Audit

What the author says it does (original text)

Google Model Armor: Sanitize a model response through a Model Armor template.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Model output may be sent to an external Google Cloud service

Source references: 3
What we found

Text, a complete JSON request, or piped input is passed to a Model Armor command identified by a project, location, and template resource. Model output can contain prompts, user content, credentials, internal data, or sensitive material printed by the preceding command. The supplied file does not state transmission, retention, or logging policies.

Why this matters

Sensitive input may enter the selected Google Cloud project and its processing or logging systems, subject to that project's access and retention policies. A full JSON body may also contain fields beyond the text intended for filtering.

The Skill sends a model response to a Google Model Armor template using `--text`, a full JSON body, or piped input. When the command is run, the output enters an external cloud service identified by project, location, and template, potentially exposing user or internal data contained in it. The supplied material does not state logging or retention policies. Users can ask for those policies and restrict inputs to content without credentials or confidential data.

SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--template` | ✓ | — | Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE) || `--text` | — | — | Text content to sanitize || `--json` | — | — | Full JSON request body (overrides --text) |
Show 2 other places
SKILL.md:37In the instructionsOpen original file
```bashgws modelarmor +sanitize-response --template projects/P/locations/L/templates/T --text 'model output'model_cmd | gws modelarmor +sanitize-response --template ...```
SKILL.md:18In the instructionsOpen original file
Sanitize a model response through a Model Armor template
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

A missing shared dependency triggers an instruction to run a file-generating command

Source references: 1
What we found

The prerequisite directs the user or agent to run `gws generate-skills` when the shared Skill is absent. Its name and stated purpose indicate Skill-file generation, but the supplied material does not identify output paths, overwrite rules, or generated content.

Why this matters

It may create or replace files in a local Skill configuration area, changing the authentication and security instructions followed by later agents. The supplied evidence does not establish the exact scope.

What this evidence establishes

This is a conditional generation command used only when the shared Skill is missing, and the wording indicates that it creates the dependency. However, the supplied material contains no implementation, destination paths, overwrite behavior, or generated content, so the specific files affected and resulting risk cannot be determined. Users can request a file/overwrite manifest and run it in a restricted directory.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The Skill's live purpose is to pass model-output text or a complete JSON request to `gws modelarmor +sanitize-response` for outbound filtering with a specified Google Model Armor template. Its pipeline example also passes the preceding command's standard output to that service.

View source
SKILL.md:23In the instructionsOpen original file
```bashgws modelarmor +sanitize-response --template <NAME>```
SKILL.md:31In the instructionsOpen original file
| `--template` | ✓ | — | Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE) || `--text` | — | — | Text content to sanitize || `--json` | — | — | Full JSON request body (overrides --text) |
SKILL.md:37In the instructionsOpen original file
```bashgws modelarmor +sanitize-response --template projects/P/locations/L/templates/T --text 'model output'model_cmd | gws modelarmor +sanitize-response --template ...```
SKILL.md:43In the instructionsOpen original file
- Use for outbound safety (model -> user).- For inbound safety (user -> model), use +sanitize-prompt.

The Skill delegates authentication, global flags, and security rules to the unprovided `../gws-shared/SKILL.md`. The supplied material therefore cannot verify credential sourcing, network destinations, logging behavior, or permission scope; the missing dependency is not evidence of safety.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
SKILL.md:48In the instructionsOpen original file
- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth- [gws-modelarmor](../gws-modelarmor/SKILL.md) — All filter user-generated content for safety commands
Start here · InstructionsSKILL.md
gws-modelarmor-sanitize-response
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws modelarmor +sanitize-response --template <NAME>
SKILL.md:36In the instructionsOpen original file
```bashgws modelarmor +sanitize-response --template projects/P/locations/L/templates/T --text 'model output'
Lines read
50
File checksum (to compare versions)
678ca1cb3a3d9ec0e0848d7f589a245006b60a48781ad7a6eaa9b29dd29eb185