Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Review Overdue Tasks Skill Security Audit

What the author says it does (original text)

Find Google Tasks that are past due and need attention.

Independent security check

Low-risk issues found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Low risk

Running the skill exposes Google Tasks lists and incomplete tasks to the agent session

Source references: 2
What we found

The commands request task-list output and all incomplete tasks in a selected list. Task names, due dates, and other table fields may contain private or work-sensitive information. The supplied lines do not instruct transmission to an outside recipient, but the data becomes visible in the execution environment or agent output.

Why this matters

If `gws` is authorized for the relevant Google account, task information may be retained in the agent session, command history, or logs.

The risk is supported, although this access directly serves the stated purpose and the source does not instruct sending the data to an outside recipient. The recipe lists the user's task lists and then returns all incomplete tasks from a selected list as a table, potentially exposing private task titles and due dates to the agent session. Before running it, the user can require an explicitly selected list, restrict Google Tasks permissions, and avoid retaining full output in session logs.

SKILL.md:24In the instructionsOpen original file
1. List task lists: `gws tasks tasklists list --format table`2. List tasks with status: `gws tasks tasks list --params '{"tasklist": "TASKLIST_ID", "showCompleted": false}' --format table`3. Review due dates and prioritize overdue items
Show 1 other places
SKILL.md:20In the instructionsOpen original file
Find Google Tasks that are past due and need attention.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The live workflow uses `gws` to list Google Tasks lists, queries incomplete tasks in a selected list, and then asks the agent to identify and prioritize overdue items from their due dates.

View source
SKILL.md:24In the instructionsOpen original file
1. List task lists: `gws tasks tasklists list --format table`2. List tasks with status: `gws tasks tasks list --params '{"tasklist": "TASKLIST_ID", "showCompleted": false}' --format table`3. Review due dates and prioritize overdue items

Execution depends on a separate `gws-tasks` skill and a local `gws` command, neither of whose implementation is included. This evidence therefore supports review of the recipe only, not how the dependency authenticates, handles data, or implements the commands.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-tasks---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-tasks`
Start here · InstructionsSKILL.md
recipe-review-overdue-tasks
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
bd47d9b98e7db066b52181554820c466ef432368f28d7c2222fd86e2ab55950e