Skip to content
skillsafebeta
← Report library
Purpose / Documents

Recipe Create Expense Tracker Skill Security Audit

What the author says it does (original text)

Set up a Google Sheets spreadsheet for tracking expenses with headers and initial entries.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Persistent read access is granted to a fixed, unconfirmed email address

Source references: 2
What we found

The workflow shares the spreadsheet directly with `manager@company.com`, an address not supplied by the user, with no confirmation step. The permission remains attached to the cloud file, so the recipient may also see expenses added later.

Why this matters

If the fixed address is not the user's authorized manager, the sample record and future entries containing amounts, travel, vendors, or other financial information could be disclosed to the wrong account.

This step actively grants the fixed address `manager@company.com` reader access to the new cloud spreadsheet. The stated purpose only covers creating an expense tracker; nothing shows that the user supplied or confirmed this recipient. If executed, that account could continue reading existing and future sensitive expense data. The user can require a runtime-confirmed address or no sharing by default.

SKILL.md:28In the instructionsOpen original file
3. Add first entry: `gws sheets +append --spreadsheet SHEET_ID --range 'Sheet1' --values '["2025-01-15", "Travel", "Flight to NYC", "450.00"]'`4. Share with manager: `gws drive permissions create --params '{"fileId": "SHEET_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "manager@company.com"}'`
Show 1 other places
SKILL.md:21In the instructionsOpen original file
Set up a Google Sheets spreadsheet for tracking expenses with headers and initial entries.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

A fixed sample expense is inserted as if it were a real ledger row

Source references: 2
What we found

The workflow does not create an empty template: it appends a fixed “Flight to NYC” expense with a date and amount. The row is not labeled as an example, and the user is not asked to confirm that it represents a real transaction.

Why this matters

If the sheet feeds reimbursement, budgeting, or management reports, the fictitious USD 450 entry could be treated as actual spending and distort totals or decisions.

The instruction appends a fixed flight expense as an ordinary row in the user's ledger rather than merely showing a command example. Although the description mentions “initial entries,” the row is not labeled as sample data and requires no confirmation. If the sheet is treated as a real ledger, it could distort records, totals, and decisions. The user can require headers only or explicit confirmation and sample labeling.

SKILL.md:27In the instructionsOpen original file
2. Add headers: `gws sheets +append --spreadsheet SHEET_ID --range 'Sheet1' --values '["Date", "Category", "Description", "Amount"]'`3. Add first entry: `gws sheets +append --spreadsheet SHEET_ID --range 'Sheet1' --values '["2025-01-15", "Travel", "Flight to NYC", "450.00"]'`4. Share with manager: `gws drive permissions create --params '{"fileId": "SHEET_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "manager@company.com"}'`
Show 1 other places
SKILL.md:21In the instructionsOpen original file
Set up a Google Sheets spreadsheet for tracking expenses with headers and initial entries.

Inside this skill

1 instruction sections

The Skill requires an authenticated Google Workspace CLI plus Sheets and Drive skills; its workflow creates a real cloud spreadsheet in the user's Google account rather than only generating a local template.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-sheets        - gws-drive---
SKILL.md:25In the instructionsOpen original file
1. Create spreadsheet: `gws drive files create --json '{"name": "Expense Tracker 2025", "mimeType": "application/vnd.google-apps.spreadsheet"}'`2. Add headers: `gws sheets +append --spreadsheet SHEET_ID --range 'Sheet1' --values '["Date", "Category", "Description", "Amount"]'`

After creation, the workflow writes fixed headers and a fixed sample expense, then creates reader permission for a fixed email address. No step is shown to confirm the recipient or mark the sample data as non-real.

View source
SKILL.md:26In the instructionsOpen original file
1. Create spreadsheet: `gws drive files create --json '{"name": "Expense Tracker 2025", "mimeType": "application/vnd.google-apps.spreadsheet"}'`2. Add headers: `gws sheets +append --spreadsheet SHEET_ID --range 'Sheet1' --values '["Date", "Category", "Description", "Amount"]'`3. Add first entry: `gws sheets +append --spreadsheet SHEET_ID --range 'Sheet1' --values '["2025-01-15", "Travel", "Flight to NYC", "450.00"]'`4. Share with manager: `gws drive permissions create --params '{"fileId": "SHEET_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "manager@company.com"}'`
Start here · InstructionsSKILL.md
recipe-create-expense-tracker
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
30
File checksum (to compare versions)
e007afec8540127c3626e2f58698bf7ed91c0732d4057e0aa401186c3877e39d