Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Create Presentation Skill Security Audit

What the author says it does (original text)

Create a new Google Slides presentation and add initial slides.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
High risk

Grants edit access to a fixed, unconfirmed email address

Source references: 3
What we found

After creating the presentation, the workflow grants the hard-coded address team@company.com the writer role. The Skill’s stated purpose only promises presentation creation and initial slides, without disclosing sharing, and the recipient is neither supplied nor confirmed by the user.

Why this matters

If the address is not the user’s intended team, its owner can view and modify the presentation. The Google Drive permission persists and would also expose sensitive material added to the file later.

The stated purpose is only to create a presentation and add initial slides, but the live procedure also grants writer access to the hard-coded team@company.com address. If step 3 is executed, that account can view and modify the new file; the source does not show that the user supplied or approved it. The user can ask why sharing is necessary and require explicit confirmation of the recipient and permission each time.

SKILL.md:3In the instructionsOpen original file
name: recipe-create-presentationdescription: "Create a new Google Slides presentation and add initial slides."metadata:
Show 2 other places
SKILL.md:26In the instructionsOpen original file
2. Get the presentation ID from the response3. Share with team: `gws drive permissions create --params '{"fileId": "PRESENTATION_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "team@company.com"}'`
SKILL.md:24In the instructionsOpen original file
1. Create presentation: `gws slides presentations create --json '{"title": "Quarterly Review Q2"}'`2. Get the presentation ID from the response3. Share with team: `gws drive permissions create --params '{"fileId": "PRESENTATION_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "team@company.com"}'`
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill claims to create a Google Slides presentation and add initial slides, but its actual steps only create a presentation titled “Quarterly Review Q2,” retrieve its ID, and set a sharing permission; no step adds slide content.

View source
SKILL.md:20In the instructionsOpen original file
Create a new Google Slides presentation and add initial slides.
SKILL.md:24In the instructionsOpen original file
1. Create presentation: `gws slides presentations create --json '{"title": "Quarterly Review Q2"}'`2. Get the presentation ID from the response3. Share with team: `gws drive permissions create --params '{"fileId": "PRESENTATION_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "team@company.com"}'`

Running the workflow creates a new cloud file in the user’s Google account and uses the file ID returned by creation for a subsequent permission change.

View source
SKILL.md:24In the instructionsOpen original file
1. Create presentation: `gws slides presentations create --json '{"title": "Quarterly Review Q2"}'`2. Get the presentation ID from the response3. Share with team: `gws drive permissions create --params '{"fileId": "PRESENTATION_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "team@company.com"}'`
Start here · InstructionsSKILL.md
recipe-create-presentation
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
cece06bc38d27a318ca6b70382e4f040458894937fe3f16ddfb0974dae868cd6