Skip to content
skillsafebeta
← Report library
Purpose / Other

Persona Project Manager Skill Security Audit

What the author says it does (original text)

Coordinate projects — track tasks, schedule meetings, and share docs.

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Project files may be uploaded and announced to an unapproved audience

Source references: 2
What we found

The Skill directly instructs the agent to upload project artifacts to Drive and then announce them, without requiring checks of file sensitivity, destination folder, access permissions, or announcement recipients.

Why this matters

If an artifact contains internal plans, customer information, or credentials, link announcements or Drive permissions could expose it to unintended people.

When the agent carries out the artifact-sharing task, it uploads the file to Drive and then announces it through a workflow. The instruction does not specify the destination folder, sharing permissions, announcement channel, or a sensitivity check, so a file could be placed where access is too broad or announced to unintended people. The suggested `--dry-run` offers a preview but is not mandatory. Users can ask the author to require confirmation of the file, location, permissions, and audience before both actions.

SKILL.md:33In the instructionsOpen original file
- Track project status in Sheets using `gws sheets +append` to log updates.- Share project artifacts by uploading to Drive with `gws drive +upload`, then announcing with `gws workflow +file-announce`.- Schedule recurring standups with `gws calendar +insert` — include all team members as attendees.
Show 1 other places
SKILL.md:40In the instructionsOpen original file
- Pipe triage output through `jq` for filtering by sender or subject.- Use `--dry-run` before any write operations to preview what will happen.
Medium risk

The weekly digest reads unread items and meetings without a defined account or project scope

Source references: 2
What we found

The Skill directs the agent to run a weekly snapshot of upcoming meetings and unread items, but does not constrain the mailbox, calendar, label, project, or time range, or require a request for that specific run.

Why this matters

On a shared or multipurpose account, the agent could process private meetings or message metadata unrelated to the project and include them in its output.

The instruction calls for a weekly digest containing upcoming meetings and unread items, which entails reading calendar and messaging data. It does not constrain the Google account, calendar, mailbox/chat scope, project label, or exact time window. If the enabled skill follows this routine, the digest could include private or confidential material unrelated to the current project. Users can ask the author to scope reads to a named account, project label, and time range, and to run only after an explicit request.

SKILL.md:31In the instructionsOpen original file
## Instructions- Start the week with `gws workflow +weekly-digest` for a snapshot of upcoming meetings and unread items.- Track project status in Sheets using `gws sheets +append` to log updates.
Show 1 other places
SKILL.md:27In the instructionsOpen original file
- `gws workflow +standup-report`- `gws workflow +weekly-digest`- `gws workflow +file-announce`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

People can be invited and status email sent without per-action approval of audience or content

Source references: 3
What we found

The Skill says to include “all team members” in calendar events and email “stakeholders,” but does not define either group or require approval of recipients, message content, timing, or recurrence.

Why this matters

It could disclose project status to the wrong people, create unwanted recurring meetings, send inaccurate information, or contact outsiders under the user's identity.

These are external actions affecting other people: creating recurring standups for “all team members” and emailing “stakeholders.” Those groups are undefined, and the text does not require confirmation of timing, recurrence, invitees, recipients, or message content. Execution could therefore create unwanted recurring events or disclose project information to the wrong people. A dry-run is suggested but not made a mandatory approval gate. Users can restrict the skill to drafts/previews and require item-by-item confirmation before sending.

SKILL.md:34In the instructionsOpen original file
- Share project artifacts by uploading to Drive with `gws drive +upload`, then announcing with `gws workflow +file-announce`.- Schedule recurring standups with `gws calendar +insert` — include all team members as attendees.- Send status update emails to stakeholders with `gws gmail +send`.
Show 2 other places
SKILL.md:35In the instructionsOpen original file
- Schedule recurring standups with `gws calendar +insert` — include all team members as attendees.- Send status update emails to stakeholders with `gws gmail +send`.
SKILL.md:40In the instructionsOpen original file
- Pipe triage output through `jq` for filtering by sender or subject.- Use `--dry-run` before any write operations to preview what will happen.
Medium risk

Unconfirmed or duplicate records may be appended to the project status sheet

Source references: 2
What we found

The Skill instructs the agent to log updates with `gws sheets +append` without requiring verification of the destination spreadsheet, worksheet, field mapping, factual accuracy, or duplicates.

Why this matters

Incorrect or repeated status entries could become a basis for team decisions and corrupt progress records, ownership, and reporting.

The instruction uses an append operation to persist updates in a Google Sheet. It does not identify the spreadsheet, worksheet, column mapping, source of truth, or deduplication rule, so choosing the wrong target or rerunning the action could create incorrect, unverified, or duplicate project records. The dry-run suggestion helps preview the change but does not explicitly require user approval before writing. Users can require a fixed target and schema, plus a preview and duplicate check before append.

SKILL.md:32In the instructionsOpen original file
- Start the week with `gws workflow +weekly-digest` for a snapshot of upcoming meetings and unread items.- Track project status in Sheets using `gws sheets +append` to log updates.- Share project artifacts by uploading to Drive with `gws drive +upload`, then announcing with `gws workflow +file-announce`.
Show 1 other places
SKILL.md:40In the instructionsOpen original file
- Pipe triage output through `jq` for filtering by sender or subject.- Use `--dry-run` before any write operations to preview what will happen.

Inside this skill

3 instruction sections

The Skill distributes project management across Google Drive, Sheets, Calendar, Gmail, and Chat, and requires the authenticated `gws` tool plus five supporting skills.

View source
SKILL.md:8In the instructionsOpen original file
    category: "persona"    requires:      bins:        - gws      skills:        - gws-drive        - gws-sheets        - gws-calendar        - gws-gmail        - gws-chat---

Its workflows read meetings and unread items, and also write to Sheets, upload files, create calendar events, and send email; it is not a read-only assistant.

View source
SKILL.md:31In the instructionsOpen original file
## Instructions- Start the week with `gws workflow +weekly-digest` for a snapshot of upcoming meetings and unread items.- Track project status in Sheets using `gws sheets +append` to log updates.- Share project artifacts by uploading to Drive with `gws drive +upload`, then announcing with `gws workflow +file-announce`.- Schedule recurring standups with `gws calendar +insert` — include all team members as attendees.- Send status update emails to stakeholders with `gws gmail +send`.

The document recommends previewing writes with `--dry-run`, but presents this only as a tip and does not require preview or user confirmation for every write.

View source
SKILL.md:40In the instructionsOpen original file
- Pipe triage output through `jq` for filtering by sender or subject.- Use `--dry-run` before any write operations to preview what will happen.
Start here · InstructionsSKILL.md
persona-project-manager
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
42
File checksum (to compare versions)
5a40725cf6cb0a358fe874d8b02d32d9a54e8739d9ff781380879cd03b2c6731