Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Create Meet Space Skill Security Audit

What the author says it does (original text)

Create a Google Meet meeting space and share the join link.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The meeting link is sent to a fixed address without user confirmation

Source references: 3
What we found

The live workflow hard-codes `team@company.com` as the recipient, while neither the stated purpose nor the preceding steps establish that this is the user's intended audience.

Why this matters

If the address exists but is not the intended participant, the open meeting link would be disclosed to the wrong mailbox. The message would also be sent under the user's Gmail identity.

The step performs an external email action and sends the meeting link to the fixed address `team@company.com`, with no preceding recipient confirmation. The address may be intended as a template placeholder, but the instruction never says to replace it, so literal execution could disclose the link to an unintended or unauthorized recipient. A user can require the recipient to be explicit input and confirm the address, subject, and body before sending.

SKILL.md:21In the instructionsOpen original file
Create a Google Meet meeting space and share the join link.
Show 2 other places
SKILL.md:27In the instructionsOpen original file
2. Copy the meeting URI from the response3. Email the link: `gws gmail +send --to team@company.com --subject 'Join the meeting' --body 'Join here: MEETING_URI'`
SKILL.md:26In the instructionsOpen original file
1. Create meeting space: `gws meet spaces create --json '{"config": {"accessType": "OPEN"}}'`2. Copy the meeting URI from the response3. Email the link: `gws gmail +send --to team@company.com --subject 'Join the meeting' --body 'Join here: MEETING_URI'`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The meeting space is explicitly created with open access

Source references: 2
What we found

The creation command hard-codes `accessType` as `OPEN` instead of deriving access from the user's choice or organizational policy.

Why this matters

People who obtain the link may be able to attempt to join without an invitation. Forwarding or leakage could therefore expand attendance beyond what the user intended.

This is an active instruction, not a warning or test: execution creates a meeting space with `accessType` set to `OPEN`. The stated purpose only says to create and share a link; it does not establish authorization for open access. If organizational policy permits this setting, people who obtain the link may be able to attempt joining without restricted membership. A user can require an explicit access-scope choice and confirmation before creation.

SKILL.md:25In the instructionsOpen original file
1. Create meeting space: `gws meet spaces create --json '{"config": {"accessType": "OPEN"}}'`2. Copy the meeting URI from the response
Show 1 other places
SKILL.md:21In the instructionsOpen original file
Create a Google Meet meeting space and share the join link.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill directs the agent to create a Google Meet space with `gws`, extract its meeting URI, and then send that link through Gmail.

View source
SKILL.md:25In the instructionsOpen original file
1. Create meeting space: `gws meet spaces create --json '{"config": {"accessType": "OPEN"}}'`2. Copy the meeting URI from the response3. Email the link: `gws gmail +send --to team@company.com --subject 'Join the meeting' --body 'Join here: MEETING_URI'`

The workflow depends on `gws-meet` and `gws-gmail`, so it would use the user's connected Google Meet and Gmail permissions. The supplied source does not include the implementations of those dependencies.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "scheduling"    requires:      bins:        - gws      skills:        - gws-meet        - gws-gmail---
SKILL.md:19In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-meet`, `gws-gmail`
Start here · InstructionsSKILL.md
recipe-create-meet-space
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
29
File checksum (to compare versions)
2a10b3af2cd338eda8107d598550b3370841afe53daa62b00a0acbf93c5433c6