Skip to content
skillsafebeta
← Report library
Purpose / Documents

Recipe Create Events From Sheet Skill Security Audit

What the author says it does (original text)

Read event data from a Google Sheets spreadsheet and create Google Calendar entries for each row.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

Creates events and attendee invitations row by row without preview or confirmation

Source references: 2
What we found

The workflow directs the agent to insert a calendar event for every retrieved row, and the example adds two attendees. It does not instruct the agent to preview the proposed events, validate dates and recipients, or obtain confirmation before bulk writes.

Why this matters

If the sheet contains mistaken, stale, or untrusted data, execution could alter the user's calendar, invite the wrong people, or disclose meeting subjects and times. The impact scales with the number of rows.

The live steps read the sheet and then directly insert an event “for each row”; the example also adds two attendee addresses. The complete provided file has no preview, date/time-zone or recipient validation, batch limit, or confirmation before writing. If the sheet has mistaken, stale, or unauthorized addresses, a run could create many incorrect events and send invitations. A user can ask for a read-only preview, explicit confirmation, a maximum-event limit, and write access restricted to a designated calendar.

SKILL.md:25In the instructionsOpen original file
1. Read event data: `gws sheets +read --spreadsheet SHEET_ID --range "Events!A2:D"`2. For each row, create a calendar event: `gws calendar +insert --summary 'Team Standup' --start '2026-01-20T09:00:00' --end '2026-01-20T09:30:00' --attendee alice@company.com --attendee bob@company.com`
Show 1 other places
SKILL.md:21In the instructionsOpen original file
Read event data from a Google Sheets spreadsheet and create Google Calendar entries for each row.
Medium risk

Rerunning the recipe may recreate every event and invitation

Source references: 1
What we found

The steps use an insertion for each row but do not record processed rows, check for existing events, or specify an idempotency key. A retry after partial failure or a later rerun would send the same row to the insertion step again.

Why this matters

The user could receive duplicate calendar entries, attendees could receive repeated invitations, and manual identification and cleanup may be required. More rows increase the disruption.

The recipe uses an insert operation for every row, while the visible steps do not record processed rows, search for existing events, or provide a stable idempotency identifier. Re-running the same sheet, or restarting after a partial failure, could therefore insert each row again and produce duplicate events and invitations. The source does not prove duplication is inevitable because `gws` or the underlying service might add safeguards; a user can ask the author to document them and check or update by a stable event ID before retries.

SKILL.md:25In the instructionsOpen original file
1. Read event data: `gws sheets +read --spreadsheet SHEET_ID --range "Events!A2:D"`2. For each row, create a calendar event: `gws calendar +insert --summary 'Team Standup' --start '2026-01-20T09:00:00' --end '2026-01-20T09:30:00' --attendee alice@company.com --attendee bob@company.com`

Inside this skill

1 instruction sections

The Skill reads columns A through D from the Events sheet, then instructs the agent to call a calendar insertion operation for every row.

View source
SKILL.md:25In the instructionsOpen original file
1. Read event data: `gws sheets +read --spreadsheet SHEET_ID --range "Events!A2:D"`2. For each row, create a calendar event: `gws calendar +insert --summary 'Team Standup' --start '2026-01-20T09:00:00' --end '2026-01-20T09:30:00' --attendee alice@company.com --attendee bob@company.com`

Execution depends on gws and two additional Skills with Google Sheets and Google Calendar capabilities. Their implementations are not included, so their authentication scope and exact behavior cannot be verified from this evidence.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-sheets        - gws-calendar---
SKILL.md:19In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-sheets`, `gws-calendar`
Start here · InstructionsSKILL.md
recipe-create-events-from-sheet
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
6c87f40619cdbe53020b5c2b13b9b3395057fa46818fa0a6d56c9b708550b842