Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Copy Sheet For New Month Skill Security Audit

What the author says it does (original text)

Duplicate a Google Sheets template tab for a new month of tracking.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Unverified hard-coded sheet IDs can copy or rename the wrong tab

Source references: 2
What we found

The copy command fixes the source at `sheetId: 0` without confirming that it is the template. The rename command then uses a separate fixed `sheetId: 123` instead of carrying forward the ID returned by the copy operation.

Why this matters

If these IDs do not match the target spreadsheet, the Skill could copy the wrong tab, rename an existing tab, or leave an incorrectly named duplicate, damaging the structure and meaning of monthly tracking data.

These are live recipe steps, not a warning or test. The copy step selects fixed `sheetId: 0`, while the rename step uses a different fixed `sheetId: 123`; the instructions neither verify that 0 is the template nor obtain the new tab ID from the copy result. If a user substitutes SHEET_ID and runs them, the recipe could copy the wrong tab, rename an unrelated tab, or fail if 123 does not exist. The user can ask the author to identify the template explicitly and pass copyTo's returned sheetId into the rename request.

SKILL.md:25In the instructionsOpen original file
1. Get spreadsheet details: `gws sheets spreadsheets get --params '{"spreadsheetId": "SHEET_ID"}'`2. Copy the template sheet: `gws sheets spreadsheets sheets copyTo --params '{"spreadsheetId": "SHEET_ID", "sheetId": 0}' --json '{"destinationSpreadsheetId": "SHEET_ID"}'`3. Rename the new tab: `gws sheets spreadsheets batchUpdate --params '{"spreadsheetId": "SHEET_ID"}' --json '{"requests": [{"updateSheetProperties": {"properties": {"sheetId": 123, "title": "February 2025"}, "fields": "title"}}]}'`
Show 1 other places
SKILL.md:26In the instructionsOpen original file
2. Copy the template sheet: `gws sheets spreadsheets sheets copyTo --params '{"spreadsheetId": "SHEET_ID", "sheetId": 0}' --json '{"destinationSpreadsheetId": "SHEET_ID"}'`3. Rename the new tab: `gws sheets spreadsheets batchUpdate --params '{"spreadsheetId": "SHEET_ID"}' --json '{"requests": [{"updateSheetProperties": {"properties": {"sheetId": 123, "title": "February 2025"}, "fields": "title"}}]}'`
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill requires `gws-sheets` and the `gws` command, so execution depends on another Skill and its Google-account authorization; that dependency's implementation is not included in the provided material.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-sheets---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-sheets`

The workflow first reads spreadsheet details, then copies a sheet into the same spreadsheet, and finally permanently changes a tab title through a batch update. The latter two steps are write operations.

View source
SKILL.md:24In the instructionsOpen original file
1. Get spreadsheet details: `gws sheets spreadsheets get --params '{"spreadsheetId": "SHEET_ID"}'`2. Copy the template sheet: `gws sheets spreadsheets sheets copyTo --params '{"spreadsheetId": "SHEET_ID", "sheetId": 0}' --json '{"destinationSpreadsheetId": "SHEET_ID"}'`3. Rename the new tab: `gws sheets spreadsheets batchUpdate --params '{"spreadsheetId": "SHEET_ID"}' --json '{"requests": [{"updateSheetProperties": {"properties": {"sheetId": 123, "title": "February 2025"}, "fields": "title"}}]}'`
Start here · InstructionsSKILL.md
recipe-copy-sheet-for-new-month
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
0bbe0ed0bae246681bb08e2332aa71280d9a4ff3bba5cab4e921d1923a96abb3