Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Reschedule Meeting Skill Security Audit

What the author says it does (original text)

Move a Google Calendar event to a new time and automatically notify all attendees.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

No final confirmation before changing the event and notifying every attendee

Source references: 4
What we found

The live instruction directly patches `EVENT_ID` on the primary calendar with `sendUpdates` set to `all`. Although the workflow reads event details first, it never requires presenting the final event, date, time zone, attendees, and notification scope for user confirmation. The command also contains a fixed example date and time zone that would become real update values if not replaced correctly.

Why this matters

If the wrong event is selected, the example time is retained, or the time zone is misunderstood, the meeting could be moved incorrectly and an erroneous notice immediately sent to every attendee, disrupting other people's schedules and harming the user's credibility.

The live workflow patches an event on the primary calendar and notifies every attendee, but it does not require verification of the final event, date, time zone, or recipients before the patch. A mistaken EVENT_ID or unreplaced example time could alter the wrong meeting and notify all attendees. Automatic notification matches the stated purpose; the risk is the missing pre-commit confirmation. Users can ask for a change summary and explicit approval, with validation that EVENT_ID, dates, and time zone were replaced.

SKILL.md:25In the instructionsOpen original file
1. Find the event: `gws calendar +agenda`2. Get event details: `gws calendar events get --params '{"calendarId": "primary", "eventId": "EVENT_ID"}'`3. Update the time: `gws calendar events patch --params '{"calendarId": "primary", "eventId": "EVENT_ID", "sendUpdates": "all"}' --json '{"start": {"dateTime": "2025-01-22T14:00:00", "timeZone": "America/New_York"}, "end": {"dateTime": "2025-01-22T15:00:00", "timeZone": "America/New_York"}}'`
Show 3 other places
SKILL.md:20In the instructionsOpen original file
Move a Google Calendar event to a new time and automatically notify all attendees.
SKILL.md:24In the instructionsOpen original file
1. Find the event: `gws calendar +agenda`2. Get event details: `gws calendar events get --params '{"calendarId": "primary", "eventId": "EVENT_ID"}'`
SKILL.md:26In the instructionsOpen original file
2. Get event details: `gws calendar events get --params '{"calendarId": "primary", "eventId": "EVENT_ID"}'`3. Update the time: `gws calendar events patch --params '{"calendarId": "primary", "eventId": "EVENT_ID", "sendUpdates": "all"}' --json '{"start": {"dateTime": "2025-01-22T14:00:00", "timeZone": "America/New_York"}, "end": {"dateTime": "2025-01-22T15:00:00", "timeZone": "America/New_York"}}'`

Inside this skill

1 instruction sections

The Skill requires `gws-calendar` and uses the `gws` command to access Google Calendar. The provided source contains no installation steps and does not show the dependency's implementation or permission scope.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "scheduling"    requires:      bins:        - gws      skills:        - gws-calendar---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-calendar`

The workflow lists the agenda, reads a selected event, and then changes that event's start and end times on the primary calendar.

View source
SKILL.md:24In the instructionsOpen original file
1. Find the event: `gws calendar +agenda`2. Get event details: `gws calendar events get --params '{"calendarId": "primary", "eventId": "EVENT_ID"}'`3. Update the time: `gws calendar events patch --params '{"calendarId": "primary", "eventId": "EVENT_ID", "sendUpdates": "all"}' --json '{"start": {"dateTime": "2025-01-22T14:00:00", "timeZone": "America/New_York"}, "end": {"dateTime": "2025-01-22T15:00:00", "timeZone": "America/New_York"}}'`
Start here · InstructionsSKILL.md
recipe-reschedule-meeting
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
deebe9946deae66660527daf1289c6deb28a81c3e79c7f57d97dbf8aa4299d21