Skip to content
skillsafebeta
← Report library
Purpose / Writing

Recipe Create Doc From Template Skill Security Audit

What the author says it does (original text)

Copy a Google Docs template, fill in content, and share with collaborators.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The workflow grants document contents and edit access to a specified email address

Source references: 3
What we found

The sharing step directly creates `writer` permission for an email address. If the copied template retains confidential material, or the address is substituted incorrectly, mistyped, or supplied by untrusted input, an unintended party receives both access and modification rights.

Why this matters

An unintended recipient could read, copy, alter, or delete content they can edit; the grant is not read-only.

Legitimate use of this code

The step does grant document-editing access to the specified email, but this is the explicitly stated purpose of the skill rather than hidden disclosure. The source uses the example address `team@company.com` and placeholder document IDs; it does not show that an address is automatically taken from untrusted input or that the template contains confidential data. Before authorizing execution, the user should still verify the recipient, template contents, and whether `writer` access is necessary.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:25In the instructionsOpen original file
1. Copy the template: `gws drive files copy --params '{"fileId": "TEMPLATE_DOC_ID"}' --json '{"name": "Project Brief - Q2 Launch"}'`2. Get the new doc ID from the response
Show 2 other places
SKILL.md:31In the instructionsOpen original file
Launch the new feature by end of Q2.'`4. Share with team: `gws drive permissions create --params '{"fileId": "NEW_DOC_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "team@company.com"}'`
SKILL.md:3In the instructionsOpen original file
name: recipe-create-doc-from-templatedescription: "Copy a Google Docs template, fill in content, and share with collaborators."metadata:
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill requires Google Drive and Google Docs skills plus the `gws` command-line tool; its effective capabilities depend on those components and the permissions granted to the connected Google account.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-drive        - gws-docs---
SKILL.md:19In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-drive`, `gws-docs`

The workflow copies a specified Google Docs template, names the new document “Project Brief - Q2 Launch,” obtains its new document ID, and writes project content into it.

View source
SKILL.md:25In the instructionsOpen original file
1. Copy the template: `gws drive files copy --params '{"fileId": "TEMPLATE_DOC_ID"}' --json '{"name": "Project Brief - Q2 Launch"}'`2. Get the new doc ID from the response3. Add content: `gws docs +write --document-id NEW_DOC_ID --text '## Project: Q2 Launch### ObjectiveLaunch the new feature by end of Q2.'`4. Share with team: `gws drive permissions create --params '{"fileId": "NEW_DOC_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "team@company.com"}'`

The final step creates `writer` permission for a specified email address, so the recipient can modify the new document rather than merely view it.

View source
SKILL.md:31In the instructionsOpen original file
Launch the new feature by end of Q2.'`4. Share with team: `gws drive permissions create --params '{"fileId": "NEW_DOC_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "team@company.com"}'`
Start here · InstructionsSKILL.md
recipe-create-doc-from-template
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
33
File checksum (to compare versions)
a8077bbb2f1c30b0226bb642c713348a87e02fc5de0a27b2f934bbbf36ece189