Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Schedule Recurring Event Skill Security Audit

What the author says it does (original text)

Create a recurring Google Calendar event with attendees.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The example directly creates an open-ended recurring meeting with a fixed external attendee

Source references: 2
What we found

The command writes to the `primary` calendar, uses a weekly recurrence with no `COUNT` or `UNTIL`, and names `team@company.com` as an attendee. The steps do not require confirmation of the calendar, recipient, time, or attendee-notification behavior.

Why this matters

If executed literally, it leaves an ongoing weekly series in the user's account, and the fixed address may belong to the wrong or unrelated organization. Depending on Google Calendar or `gws` notification settings, that attendee may also receive an unintended invitation or update.

This is the recipe’s active creation step. If run unchanged, it writes to the current account’s primary calendar, repeats every Monday without an end because the RRULE has no COUNT or UNTIL, and adds team@company.com as an attendee. The address may be a placeholder, and the source does not specify whether Google sends notifications, so it does not prove an external party receives an invitation. Users can require confirmation of the calendar, date, time zone, attendees, and recurrence end, with a parameter preview before creation.

SKILL.md:24In the instructionsOpen original file
1. Create recurring event: `gws calendar events insert --params '{"calendarId": "primary"}' --json '{"summary": "Weekly Standup", "start": {"dateTime": "2024-03-18T09:00:00", "timeZone": "America/New_York"}, "end": {"dateTime": "2024-03-18T09:30:00", "timeZone": "America/New_York"}, "recurrence": ["RRULE:FREQ=WEEKLY;BYDAY=MO"], "attendees": [{"email": "team@company.com"}]}'`2. Verify it was created: `gws calendar +agenda --days 14 --format table`
Show 1 other places
SKILL.md:20In the instructionsOpen original file
Create a recurring Google Calendar event with attendees.

Inside this skill

1 instruction sections

The Skill requires `gws-calendar`, then uses `gws` to write a Monday-recurring “Weekly Standup” to the user's primary Google Calendar and checks the result through a 14-day agenda view.

View source
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-calendar`
SKILL.md:24In the instructionsOpen original file
1. Create recurring event: `gws calendar events insert --params '{"calendarId": "primary"}' --json '{"summary": "Weekly Standup", "start": {"dateTime": "2024-03-18T09:00:00", "timeZone": "America/New_York"}, "end": {"dateTime": "2024-03-18T09:30:00", "timeZone": "America/New_York"}, "recurrence": ["RRULE:FREQ=WEEKLY;BYDAY=MO"], "attendees": [{"email": "team@company.com"}]}'`2. Verify it was created: `gws calendar +agenda --days 14 --format table`
Start here · InstructionsSKILL.md
recipe-schedule-recurring-event
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
27
File checksum (to compare versions)
9831dd877cf40dc14fc2a21f84e179d179f860411f0341d997b852c0d1e248fe