Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Create Task List Skill Security Audit

What the author says it does (original text)

Set up a new Google Tasks list with initial tasks.

Independent security check

Low-risk issues found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

Running the recipe verbatim writes fixed example tasks to the user’s Google Tasks

Source references: 2
What we found

The steps are write commands with a fixed list name, task content, and an already-past due date; the instructions do not require replacing these values with user-confirmed content before execution.

Why this matters

If an agent treats the recipe as directly executable, unrelated, duplicate, or incorrectly dated items may be added to the user’s account.

These are presented as the recipe’s execution steps, not merely illustrative examples. They create a list named “Q2 Goals” and insert two fixed tasks, one with a 2024-04-01 due date. If an agent follows the steps, that content would be written to the user’s authorized Google Tasks account; the visible text provides no confirmation step for the titles, notes, or date. A user can ask for a preview and explicit confirmation, and restrict access to a designated task list.

SKILL.md:24In the instructionsOpen original file
1. Create task list: `gws tasks tasklists insert --json '{"title": "Q2 Goals"}'`2. Add a task: `gws tasks tasks insert --params '{"tasklist": "TASKLIST_ID"}' --json '{"title": "Review Q1 metrics", "notes": "Pull data from analytics dashboard", "due": "2024-04-01T00:00:00Z"}'`3. Add another task: `gws tasks tasks insert --params '{"tasklist": "TASKLIST_ID"}' --json '{"title": "Draft Q2 OKRs"}'`4. List tasks: `gws tasks tasks list --params '{"tasklist": "TASKLIST_ID"}' --format table`
Show 1 other places
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-tasks`Set up a new Google Tasks list with initial tasks.

Inside this skill

1 instruction sections

The live steps use `gws` to create a “Q2 Goals” list in the signed-in Google account, add two tasks, and then display the tasks. These are not read-only examples: the first three commands change account data.

View source
SKILL.md:24In the instructionsOpen original file
1. Create task list: `gws tasks tasklists insert --json '{"title": "Q2 Goals"}'`2. Add a task: `gws tasks tasks insert --params '{"tasklist": "TASKLIST_ID"}' --json '{"title": "Review Q1 metrics", "notes": "Pull data from analytics dashboard", "due": "2024-04-01T00:00:00Z"}'`3. Add another task: `gws tasks tasks insert --params '{"tasklist": "TASKLIST_ID"}' --json '{"title": "Draft Q2 OKRs"}'`4. List tasks: `gws tasks tasks list --params '{"tasklist": "TASKLIST_ID"}' --format table`

The recipe requires a separate `gws-tasks` Skill and the `gws` executable. Their implementation is not included in the supplied source, so this audit can confirm only the commands shown here, not whether the dependency performs additional actions.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-tasks---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-tasks`
Start here · InstructionsSKILL.md
recipe-create-task-list
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
29
File checksum (to compare versions)
3f790921ef75e545c2051c5bdbc611aba6640353ec522973f9232a6a1c109220