Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Recipe Generate Report From Sheet Skill Security Audit

What the author says it does (original text)

Read data from a Google Sheet and create a formatted Google Docs report.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

The report is shared with a hard-coded email address

Source references: 4
What we found

After creating the report, the Skill directly grants reader access to `cfo@company.com`. Its stated purpose mentions creating a report but does not establish authorization to disclose it to that address.

Why this matters

If this is not a user-confirmed recipient, the account holder can read sales, revenue, and deal information in the report.

This is an active recipe step, not a warning or a described example. If step 4 is run with a valid DOC_ID, it grants the hard-coded cfo@company.com account read access to the generated report. The stated purpose mentions reading a sheet and creating a report, but does not disclose this sharing or require confirmation of the recipient, so sheet-derived data could be exposed to a wrong or unauthorized account. A user can require explicit confirmation of the address and authorization, or restrict Drive permission creation.

SKILL.md:3In the instructionsOpen original file
name: recipe-generate-report-from-sheetdescription: "Read data from a Google Sheet and create a formatted Google Docs report."metadata:
Show 3 other places
SKILL.md:30In the instructionsOpen original file
### SummaryTotal deals: 45Revenue: $125,000### Top Deals1. Acme Corp - $25,0002. Widget Inc - $18,000'`4. Share with stakeholders: `gws drive permissions create --params '{"fileId": "DOC_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "cfo@company.com"}'`
SKILL.md:37In the instructionsOpen original file
2. Widget Inc - $18,000'`4. Share with stakeholders: `gws drive permissions create --params '{"fileId": "DOC_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "cfo@company.com"}'`
SKILL.md:2In the instructionsOpen original file
---name: recipe-generate-report-from-sheetdescription: "Read data from a Google Sheet and create a formatted Google Docs report."metadata:
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The report uses fixed sales figures rather than the sheet result

Source references: 2
What we found

Step 1 reads the sheet, but the write command does not reference its output. It inserts fixed values for 45 deals, $125,000 revenue, and two named customers and amounts.

Why this matters

The operator may create and share a report that conflicts with the actual spreadsheet, causing financial or operational decisions to rely on incorrect data.

Step 1 reads the sheet, but the later write command contains fixed text and shows no step that calculates or inserts the retrieved values. If followed as written, the report will claim 45 deals, $125,000 revenue, and the listed customer amounts regardless of the actual sheet, which could mislead business decisions. A user can ask the author to label these values as placeholders and provide an explicit process to derive, validate, and preview the report from the read result.

SKILL.md:26In the instructionsOpen original file
1. Read the data: `gws sheets +read --spreadsheet SHEET_ID --range "Sales!A1:D"`2. Create the report doc: `gws docs documents create --json '{"title": "Sales Report - January 2025"}'`
Show 1 other places
SKILL.md:28In the instructionsOpen original file
2. Create the report doc: `gws docs documents create --json '{"title": "Sales Report - January 2025"}'`3. Write the report: `gws docs +write --document-id DOC_ID --text '## Sales Report - January 2025### SummaryTotal deals: 45Revenue: $125,000### Top Deals1. Acme Corp - $25,0002. Widget Inc - $18,000'`4. Share with stakeholders: `gws drive permissions create --params '{"fileId": "DOC_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "cfo@company.com"}'`

Inside this skill

1 instruction sections

The Skill requires Google Sheets, Docs, and Drive skills and uses `gws` commands to operate Google Workspace.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-sheets        - gws-docs        - gws-drive---
SKILL.md:20In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-sheets`, `gws-docs`, `gws-drive`

The workflow reads a sheet, creates a Google document, writes a report, and finally grants a named user read access.

View source
SKILL.md:26In the instructionsOpen original file
1. Read the data: `gws sheets +read --spreadsheet SHEET_ID --range "Sales!A1:D"`2. Create the report doc: `gws docs documents create --json '{"title": "Sales Report - January 2025"}'`3. Write the report: `gws docs +write --document-id DOC_ID --text '## Sales Report - January 2025
SKILL.md:37In the instructionsOpen original file
2. Widget Inc - $18,000'`4. Share with stakeholders: `gws drive permissions create --params '{"fileId": "DOC_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "cfo@company.com"}'`
Start here · InstructionsSKILL.md
recipe-generate-report-from-sheet
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
39
File checksum (to compare versions)
e1610f11858b60108a542852230f6a88751289454bc20d3ff170e055752c81dc