Skip to content
skillsafebeta
← Report library
Purpose / Other

Persona Event Coordinator Skill Security Audit

What the author says it does (original text)

Plan and manage events — scheduling, invitations, and logistics.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Event materials and details may be sent to unconfirmed recipients or Chat spaces

Source references: 3
What we found

The Skill directs the agent to upload materials, email details and links, and announce updates in Chat, but does not require checking material sensitivity, recipients, link permissions, or the destination space before sending.

Why this matters

An incorrect attendee list, Chat space, or sharing setting could expose locations, participant information, internal materials, and Drive links to unauthorized people.

These are active operating instructions, not examples or warnings. During an event workflow, the Skill uploads materials to Drive, emails event details and links, and posts updates to Chat spaces, without requiring prior checks of recipients, target spaces, material sensitivity, or link access. A wrong list, space, or sharing setting could expose event information to unintended people. Users can ask for pre-send previews, recipient/space confirmation, least-privilege link checks, and restricted send permissions.

SKILL.md:32In the instructionsOpen original file
- Create event calendar entries with `gws calendar +insert` — include location and attendee lists.- Prepare event materials and upload to Drive with `gws drive +upload`.- Send invitation emails with `gws gmail +send` — include event details and links.- Announce updates in Chat spaces with `gws workflow +file-announce`.- Track RSVPs and logistics in Sheets with `gws sheets +append`.
Show 2 other places
SKILL.md:33In the instructionsOpen original file
- Prepare event materials and upload to Drive with `gws drive +upload`.- Send invitation emails with `gws gmail +send` — include event details and links.- Announce updates in Chat spaces with `gws workflow +file-announce`.
SKILL.md:34In the instructionsOpen original file
- Send invitation emails with `gws gmail +send` — include event details and links.- Announce updates in Chat spaces with `gws workflow +file-announce`.- Track RSVPs and logistics in Sheets with `gws sheets +append`.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The Skill can directly create and modify persistent records in a Google account

Source references: 4
What we found

The instructions call for inserting calendar events, uploading Drive files, and appending Sheet rows without specifying preview, per-action approval, deduplication, or rollback. Bulk attendee insertion may also issue many invitations immediately.

Why this matters

Mistakes or repeated runs could leave incorrect calendar events, duplicate invitations, unintended cloud files, and inaccurate RSVP or logistics records, affecting real participants.

The Skill explicitly directs creation of calendar events, Drive uploads, and appended Sheet records, all of which persist in the Google account. It also recommends repeated attendee flags for bulk invitations, without preview, deduplication, per-action approval, or rollback requirements. Execution could create incorrect records, duplicate entries, or invite many unintended attendees. Users can restrict access to read-only or require a change preview and explicit approval before each write and bulk invite.

SKILL.md:31In the instructionsOpen original file
## Instructions- Create event calendar entries with `gws calendar +insert` — include location and attendee lists.- Prepare event materials and upload to Drive with `gws drive +upload`.- Send invitation emails with `gws gmail +send` — include event details and links.
Show 3 other places
SKILL.md:35In the instructionsOpen original file
- Announce updates in Chat spaces with `gws workflow +file-announce`.- Track RSVPs and logistics in Sheets with `gws sheets +append`.
SKILL.md:40In the instructionsOpen original file
- Create a dedicated calendar for each major event series.- Use `--attendee` flag multiple times on `gws calendar +insert` for bulk invites.
SKILL.md:32In the instructionsOpen original file
- Create event calendar entries with `gws calendar +insert` — include location and attendee lists.- Prepare event materials and upload to Drive with `gws drive +upload`.- Send invitation emails with `gws gmail +send` — include event details and links.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This Skill is an event-coordination persona that depends on the `gws` tool and supporting skills with access to Google Calendar, Gmail, Drive, Chat, and Sheets.

View source
SKILL.md:8In the instructionsOpen original file
    category: "persona"    requires:      bins:        - gws      skills:        - gws-calendar        - gws-gmail        - gws-drive        - gws-chat        - gws-sheets---

Its workflow creates calendar events with locations and attendees, uploads event materials, sends invitation emails, and posts updates to Chat spaces.

View source
SKILL.md:31In the instructionsOpen original file
## Instructions- Create event calendar entries with `gws calendar +insert` — include location and attendee lists.- Prepare event materials and upload to Drive with `gws drive +upload`.- Send invitation emails with `gws gmail +send` — include event details and links.- Announce updates in Chat spaces with `gws workflow +file-announce`.- Track RSVPs and logistics in Sheets with `gws sheets +append`.

The Skill also appends RSVP and logistics information to Sheets and recommends using a 30-day agenda view for planning.

View source
SKILL.md:35In the instructionsOpen original file
- Announce updates in Chat spaces with `gws workflow +file-announce`.- Track RSVPs and logistics in Sheets with `gws sheets +append`.## Tips- Use `gws calendar +agenda --days 30` for long-range event planning.- Create a dedicated calendar for each major event series.
Start here · InstructionsSKILL.md
persona-event-coordinator
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
42
File checksum (to compare versions)
76ddcd62b4863e7fdfcd281cc0b17760509ab834b8513f474107000fa6d0f5da