Skip to content
Report library
Purpose / Other

Recipe Review Meet Participants Skill Security Audit

What the author says it does (original text)

Review who attended a Google Meet conference and for how long.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Unscoped listing may expose unrelated meeting records

Source references: 3
What we found

The first step supplies no conference ID, time range, or other filter; it lists recent conferences visible to the active Google Workspace identity. Those table results may enter the agent context or be shown to the operator even when the user intended to review only one meeting.

Why this matters

Records for meetings unrelated to the request may be disclosed unintentionally. Later queries also display participants and individual session details for the selected meeting. The actual exposure depends on the account permissions used by `gws`.

The stated purpose is to review attendance for a conference, but the first command lists recent conferences visible to the current Google Workspace identity without a conference ID, time range, or other filter. Its table output could expose records for unrelated meetings in the terminal or agent context. Only later steps narrow access to a specific CONFERENCE_ID. A user can ask the author to accept a meeting ID directly or require confirmation and a time/query constraint before listing.

SKILL.md:24In the instructionsOpen original file
1. List recent conferences: `gws meet conferenceRecords list --format table`2. List participants: `gws meet conferenceRecords participants list --params '{"parent": "conferenceRecords/CONFERENCE_ID"}' --format table`
Show 2 other places
SKILL.md:25In the instructionsOpen original file
1. List recent conferences: `gws meet conferenceRecords list --format table`2. List participants: `gws meet conferenceRecords participants list --params '{"parent": "conferenceRecords/CONFERENCE_ID"}' --format table`3. Get session details: `gws meet conferenceRecords participants participantSessions list --params '{"parent": "conferenceRecords/CONFERENCE_ID/participants/PARTICIPANT_ID"}' --format table`
SKILL.md:20In the instructionsOpen original file
Review who attended a Google Meet conference and for how long.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This Skill is a read-only Google Meet attendance review workflow: it lists recent conferences, queries participants for a selected conference, and then queries session details for a participant. The provided instructions contain no command that modifies or deletes meeting data.

View source
SKILL.md:24In the instructionsOpen original file
1. List recent conferences: `gws meet conferenceRecords list --format table`2. List participants: `gws meet conferenceRecords participants list --params '{"parent": "conferenceRecords/CONFERENCE_ID"}' --format table`3. Get session details: `gws meet conferenceRecords participants participantSessions list --params '{"parent": "conferenceRecords/CONFERENCE_ID/participants/PARTICIPANT_ID"}' --format table`

The workflow depends on the local `gws` command and a separate `gws-meet` Skill. That dependency's implementation is not included, so its authentication, data transmission, and credential handling cannot be assessed from this evidence.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-meet---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-meet`
Start here · InstructionsSKILL.md
recipe-review-meet-participants
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
8748e77183d428e14233ec0ea4497a5767ee981d42e35043974bf28002ad6cdf