Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Email Drive Link Skill Security Audit

What the author says it does (original text)

Share a Google Drive file and email the link with a message to recipients.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Access is granted and the link sent without requiring file and recipient confirmation

Source references: 1
What we found

After a name-based search, the workflow immediately creates reader permission and sends an email. It does not explicitly require confirmation of the selected `FILE_ID`, recipient address, or file sensitivity. Duplicate names or incorrect placeholder substitution could expose the file to the wrong person.

Why this matters

An unintended recipient could retain access to the Drive file and receive a link that can be used or forwarded. A sent email also cannot generally be removed from the recipient's mailbox.

These are placeholder commands and do not execute merely because the document is read. However, the live recipe directs the agent to search by name, then immediately grant read access and email the link, without requiring confirmation of a unique FILE_ID, the recipient, or file sensitivity. If a duplicate-name file is selected or the address is substituted incorrectly, an unintended person could gain access. A user can ask for an explicit pre-send confirmation and restrict execution to a specified file ID and recipient.

SKILL.md:25In the instructionsOpen original file
1. Find the file: `gws drive files list --params '{"q": "name = '\''Quarterly Report'\''"}'`2. Share the file: `gws drive permissions create --params '{"fileId": "FILE_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "client@example.com"}'`3. Email the link: `gws gmail +send --to client@example.com --subject 'Quarterly Report' --body 'Hi, please find the report here: https://docs.google.com/document/d/FILE_ID'`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill declares dependencies on `gws-drive` and `gws-gmail`; actual Google-account access is performed by those unprovided Skills and the `gws` command. This review can assess the recipe, but not how those dependencies handle credentials or authorization.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-drive        - gws-gmail---
SKILL.md:19In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-drive`, `gws-gmail`

The recipe searches for a file by name, creates reader access for a specified email address, and then emails that address a Drive document link. The shown filename, address, and `FILE_ID` are example values that must be replaced correctly during real use.

View source
SKILL.md:25In the instructionsOpen original file
1. Find the file: `gws drive files list --params '{"q": "name = '\''Quarterly Report'\''"}'`2. Share the file: `gws drive permissions create --params '{"fileId": "FILE_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "client@example.com"}'`3. Email the link: `gws gmail +send --to client@example.com --subject 'Quarterly Report' --body 'Hi, please find the report here: https://docs.google.com/document/d/FILE_ID'`
Start here · InstructionsSKILL.md
recipe-email-drive-link
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:27In the instructionsOpen original file
2. Share the file: `gws drive permissions create --params '{"fileId": "FILE_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "client@example.com"}'`3. Email the link: `gws gmail +send --to client@example.com --subject 'Quarterly Report' --body 'Hi, please find the report here: https://docs.google.com/document/d/FILE_ID'`
Lines read
29
File checksum (to compare versions)
8d6f3760bd996ff8985a7f1ebbbeb94bc692dc9330225d970b5aa87bb0b1609e