Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Find Free Time Skill Security Audit

What the author says it does (original text)

Query Google Calendar free/busy status for multiple users to find a meeting slot.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
High risk

It creates and invites people after the query, exceeding the stated read-only discovery purpose

Source references: 4
What we found

The description promises to query availability to find a slot, but the final step invokes `calendar +insert` to create a “Meeting” and add two attendees. It does not require presenting the final time, confirming the organizer calendar, or obtaining approval before the write.

Why this matters

If an agent executes the whole recipe automatically, it could create an event in the wrong account or at the wrong time and send or trigger invitations, changing calendars and notifications for the user and attendees.

The source supports this risk. The stated purpose is to query availability and find a meeting slot, but the procedure also directs the agent to call `calendar +insert` and add two example attendees. If the full recipe is followed, it modifies the user's calendar and may send invitations; no pre-write confirmation appears in the steps. A user can ask the author to make creation explicitly optional and restrict execution until the proposed time, organizer calendar, and attendees are shown and approved.

SKILL.md:3In the instructionsOpen original file
name: recipe-find-free-timedescription: "Query Google Calendar free/busy status for multiple users to find a meeting slot."metadata:
Show 3 other places
SKILL.md:20In the instructionsOpen original file
Query Google Calendar free/busy status for multiple users to find a meeting slot.
SKILL.md:26In the instructionsOpen original file
2. Review the output to find overlapping free slots3. Create event in the free slot: `gws calendar +insert --summary 'Meeting' --attendee user1@company.com --attendee user2@company.com --start '2024-03-18T14:00:00' --end '2024-03-18T14:30:00'`
SKILL.md:24In the instructionsOpen original file
1. Query free/busy: `gws calendar freebusy query --json '{"timeMin": "2024-03-18T08:00:00Z", "timeMax": "2024-03-18T18:00:00Z", "items": [{"id": "user1@company.com"}, {"id": "user2@company.com"}]}'`2. Review the output to find overlapping free slots3. Create event in the free slot: `gws calendar +insert --summary 'Meeting' --attendee user1@company.com --attendee user2@company.com --start '2024-03-18T14:00:00' --end '2024-03-18T14:30:00'`
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill queries Google Calendar free/busy status for named people during a specified time range, then asks the operator to identify an overlapping free slot.

View source
SKILL.md:24In the instructionsOpen original file
1. Query free/busy: `gws calendar freebusy query --json '{"timeMin": "2024-03-18T08:00:00Z", "timeMax": "2024-03-18T18:00:00Z", "items": [{"id": "user1@company.com"}, {"id": "user2@company.com"}]}'`2. Review the output to find overlapping free slots3. Create event in the free slot: `gws calendar +insert --summary 'Meeting' --attendee user1@company.com --attendee user2@company.com --start '2024-03-18T14:00:00' --end '2024-03-18T14:30:00'`

It depends on the local `gws` command and a separate `gws-calendar` Skill. That dependency is not included, so its authentication, data handling, and network behavior cannot be verified from this source.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "scheduling"    requires:      bins:        - gws      skills:        - gws-calendar---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-calendar`
Start here · InstructionsSKILL.md
recipe-find-free-time
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
5a4a44fc368db425f7716b700ce262a39493332eccdbf71be48396d46289e250