Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Share Event Materials Skill Security Audit

What the author says it does (original text)

Share Google Drive files with all attendees of a Google Calendar event.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

The file is shared directly with every event attendee without first checking for external or unintended recipients

Source references: 2
What we found

The workflow takes the calendar event’s attendees as sharing targets and creates a user-level reader permission for each one. It provides no recipient preview, domain restriction, external-guest exclusion, or per-recipient confirmation. Clients, forwarded invitees, or mistaken addresses on the event could therefore receive access.

Why this matters

The selected file’s contents could be disclosed to people who should not have access; the newly created Drive permission remains effective until revoked.

The skill explicitly uses event attendees to create individual Google Drive reader permissions, with no visible roster preview, external-domain restriction, or pre-sharing confirmation. If the event contains an incorrect address or external guest, step 2 could grant that address access. Users can ask the author to add recipient preview and confirmation and restrict grants to approved addresses or organizational domains.

SKILL.md:21In the instructionsOpen original file
Share Google Drive files with all attendees of a Google Calendar event.
Show 1 other places
SKILL.md:25In the instructionsOpen original file
1. Get event attendees: `gws calendar events get --params '{"calendarId": "primary", "eventId": "EVENT_ID"}'`2. Share file with each attendee: `gws drive permissions create --params '{"fileId": "FILE_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "attendee@company.com"}'`3. Verify sharing: `gws drive permissions list --params '{"fileId": "FILE_ID"}' --format table`
Low risk

The verification command prints the file’s permission list to the terminal

Source references: 1
What we found

The final step lists permissions for the specified file in table form. Permission records are access-control information and may include authorized users’ identities; the supplied instructions do not minimize or redact that output.

Why this matters

If terminal output is recorded, pasted into a ticket, or retained in shared logs, information about who can access the file may be exposed further.

Step 3 explicitly lists the file's permissions as a terminal table. This is a legitimate sharing check, but access-control information could be exposed if terminal output is logged, shared, or observed. The source does not show the returned fields, so inclusion of email addresses or other identities is uncertain. Users can ask for only necessary fields to be displayed and avoid running it in shared logs.

SKILL.md:27In the instructionsOpen original file
2. Share file with each attendee: `gws drive permissions create --params '{"fileId": "FILE_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "attendee@company.com"}'`3. Verify sharing: `gws drive permissions list --params '{"fileId": "FILE_ID"}' --format table`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This Skill is a command-line recipe: it reads a specified event from the primary calendar, creates a user-level “reader” permission on a specified Drive file, and then lists the file permissions for verification.

View source
SKILL.md:25In the instructionsOpen original file
1. Get event attendees: `gws calendar events get --params '{"calendarId": "primary", "eventId": "EVENT_ID"}'`2. Share file with each attendee: `gws drive permissions create --params '{"fileId": "FILE_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "attendee@company.com"}'`3. Verify sharing: `gws drive permissions list --params '{"fileId": "FILE_ID"}' --format table`

The recipe depends on the `gws-calendar` and `gws-drive` Skills and the `gws` program, none of which are included in this source; their credential handling, network requests, and command-argument handling therefore cannot be verified from the supplied material.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-calendar        - gws-drive---
SKILL.md:19In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-calendar`, `gws-drive`
Start here · InstructionsSKILL.md
recipe-share-event-materials
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
29
File checksum (to compare versions)
bc09dc4bf44f9e92fbd2b7ef575fc7697dfad7b31e8dc1a320e2b5c30ce3ee53