Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Collect Form Responses Skill Security Audit

What the author says it does (original text)

Retrieve and review responses from a Google Form.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

The fallback step enumerates forms available to the connected account

Source references: 1
What we found

The workflow recommends an unscoped `forms list` command when the ID is unknown. This may expose names or metadata for forms unrelated to the task to the executing agent and its logs.

Why this matters

On a shared account or one containing sensitive projects, the existence and metadata of unrelated forms may be disclosed.

When the user does not provide a form ID, this active step lists the forms available to the account, with no visible name, folder, or other scope restriction. That serves the stated goal of locating the target form, but could expose unrelated form names or metadata to the agent context or command logs. A user can provide the form ID directly or ask the author to document returned fields and support a narrower lookup.

SKILL.md:24In the instructionsOpen original file
1. List forms: `gws forms forms list` (if you don't have the form ID)2. Get form details: `gws forms forms get --params '{"formId": "FORM_ID"}'`
Medium risk

The response command may expose the form's complete response set to agent context or logs

Source references: 1
What we found

Step 3 uses `responses list` with table output and shows no limit by response count, field, date, or respondent. Form responses can contain contact details, free text, or other sensitive information.

Why this matters

Responses beyond what is needed for the review may be read and retained in terminal history, agent context, or execution logs.

This active step lists responses for a form ID and formats them as a table; the visible command has no limit, date, field, or respondent filter. If the target form contains contact details, free text, or other sensitive data, all returned responses could enter the agent context or logs. A user can require confirmation of the form and needed scope first, and request field, date, or count limits, although the source does not show whether the tool supports them.

SKILL.md:26In the instructionsOpen original file
2. Get form details: `gws forms forms get --params '{"formId": "FORM_ID"}'`3. Get responses: `gws forms forms responses list --params '{"formId": "FORM_ID"}' --format table`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This Skill is a Google Forms workflow that requires the `gws` executable and the `gws-forms` Skill. Their implementations are not included, so this review can assess only the commands explicitly shown here.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-forms---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-forms`

The workflow can list forms, retrieve one form's details, and obtain that form's responses in table format.

View source
SKILL.md:24In the instructionsOpen original file
1. List forms: `gws forms forms list` (if you don't have the form ID)2. Get form details: `gws forms forms get --params '{"formId": "FORM_ID"}'`3. Get responses: `gws forms forms responses list --params '{"formId": "FORM_ID"}' --format table`
Start here · InstructionsSKILL.md
recipe-collect-form-responses
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
ccbffd8f0117abb72bab43a386faedb764e4206703c54516d0692812ef2e822f