Skip to content
Report library
Purpose / Documents

Gws Sheets Append Skill Security Audit

What the author says it does (original text)

Google Sheets: Append a row to a spreadsheet.

Independent security check

Low-risk issues found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

Omitting the sheet range can append data to an unintended tab

Source references: 5
What we found

`--range` is optional and defaults to `A1`, which the documentation says selects the first sheet. A correct spreadsheet ID may therefore still target the wrong tab in a multi-tab spreadsheet.

Why this matters

If executed without an explicit range, one or many rows can be persistently appended to the first tab, potentially contaminating business data and requiring manual cleanup.

The source supports this risk: `--range` is optional, defaults to `A1`, and the documentation says this means the first sheet. In a multi-tab spreadsheet, omitting the range could therefore append data to an unintended tab. The skill also requires user confirmation before writing, which reduces but does not remove ambiguity about the target. The user can require the spreadsheet ID, tab, and range to be shown and confirmed before every write.

SKILL.md:32In the instructionsOpen original file
| `--values` | — | — | Comma-separated values (simple strings) || `--json-values` | — | — | JSON array of rows, e.g. '[["a","b"],["c","d"]]' || `--range` | — | `A1` | Target range in A1 notation (e.g. 'Sheet2!A1') to select a specific tab |
Show 4 other places
SKILL.md:45In the instructionsOpen original file
- Use --values for simple single-row appends.- Use --json-values for bulk multi-row inserts.- Use --range to append to a specific sheet tab (default: A1, i.e. first sheet).
SKILL.md:33In the instructionsOpen original file
| `--json-values` | — | — | JSON array of rows, e.g. '[["a","b"],["c","d"]]' || `--range` | — | `A1` | Target range in A1 notation (e.g. 'Sheet2!A1') to select a specific tab |
SKILL.md:47In the instructionsOpen original file
- Use --json-values for bulk multi-row inserts.- Use --range to append to a specific sheet tab (default: A1, i.e. first sheet).
SKILL.md:49In the instructionsOpen original file
> [!CAUTION]> This is a **write** command — confirm with the user before executing.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This Skill uses `gws` to append data to a specified Google spreadsheet, supporting both a comma-separated single row and JSON-formatted bulk rows.

View source
SKILL.md:23In the instructionsOpen original file
```bashgws sheets +append --spreadsheet <ID>```
SKILL.md:31In the instructionsOpen original file
| `--spreadsheet` | ✓ | — | Spreadsheet ID || `--values` | — | — | Comma-separated values (simple strings) || `--json-values` | — | — | JSON array of rows, e.g. '[["a","b"],["c","d"]]' || `--range` | — | `A1` | Target range in A1 notation (e.g. 'Sheet2!A1') to select a specific tab |

This is a write operation that changes a cloud spreadsheet. The Skill explicitly requires user confirmation before execution.

View source
SKILL.md:49In the instructionsOpen original file
> [!CAUTION]> This is a **write** command — confirm with the user before executing.

Authentication, global flags, and security rules are delegated to a neighboring shared Skill that is not included here; if it is absent, this Skill instructs the agent to run a generation command. The supplied evidence therefore does not allow verification of its authorization scope or generation behavior.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Start here · InstructionsSKILL.md
gws-sheets-append
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws sheets +append --spreadsheet <ID>
SKILL.md:37In the instructionsOpen original file
```bashgws sheets +append --spreadsheet ID --values 'Alice,100,true'
Lines read
56
File checksum (to compare versions)
2dbd4e36e6ac85cc2caf0b77e84a98ff4eb208a152551b747d9e0805ac59843e