Skip to content
skillsafebeta
← Report library
Purpose / Writing

Recipe Share Folder With Team Skill Security Audit

What the author says it does (original text)

Share a Google Drive folder and all its contents with a list of collaborators.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

The whole folder could be exposed to the wrong account if the folder and recipients are not confirmed individually

Source references: 4
What we found

The workflow directly creates folder-level `writer` and `reader` permissions for specified email addresses. Its stated scope is the folder and all contents, so a wrong folder ID or incorrectly substituted example address affects more than one file.

Why this matters

An unintended recipient could read the folder’s contents; a recipient given `writer` access could also modify them. The permission persists until it is revoked separately.

The recipe finds a folder by name, then directly creates folder-level access using placeholder folder IDs and email addresses; verification occurs only afterward. If the wrong search result, FOLDER_ID, or address is used, an unintended account could read the folder and its contents, while a writer could also modify them. Users can ask for a pre-action confirmation of the folder ID/name, recipient, and role, and restrict access to reader where possible.

SKILL.md:20In the instructionsOpen original file
Share a Google Drive folder and all its contents with a list of collaborators.
Show 3 other places
SKILL.md:24In the instructionsOpen original file
1. Find the folder: `gws drive files list --params '{"q": "name = '\''Project X'\'' and mimeType = '\''application/vnd.google-apps.folder'\''"}'`2. Share as editor: `gws drive permissions create --params '{"fileId": "FOLDER_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "colleague@company.com"}'`3. Share as viewer: `gws drive permissions create --params '{"fileId": "FOLDER_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "stakeholder@company.com"}'`4. Verify permissions: `gws drive permissions list --params '{"fileId": "FOLDER_ID"}' --format table`
SKILL.md:25In the instructionsOpen original file
1. Find the folder: `gws drive files list --params '{"q": "name = '\''Project X'\'' and mimeType = '\''application/vnd.google-apps.folder'\''"}'`2. Share as editor: `gws drive permissions create --params '{"fileId": "FOLDER_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "colleague@company.com"}'`3. Share as viewer: `gws drive permissions create --params '{"fileId": "FOLDER_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "stakeholder@company.com"}'`
SKILL.md:27In the instructionsOpen original file
3. Share as viewer: `gws drive permissions create --params '{"fileId": "FOLDER_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "stakeholder@company.com"}'`4. Verify permissions: `gws drive permissions list --params '{"fileId": "FOLDER_ID"}' --format table`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill uses the Google Workspace CLI to search for a folder named “Project X,” create one editor permission and one viewer permission on the selected folder ID, and then list its permissions for verification.

View source
SKILL.md:24In the instructionsOpen original file
1. Find the folder: `gws drive files list --params '{"q": "name = '\''Project X'\'' and mimeType = '\''application/vnd.google-apps.folder'\''"}'`2. Share as editor: `gws drive permissions create --params '{"fileId": "FOLDER_ID"}' --json '{"role": "writer", "type": "user", "emailAddress": "colleague@company.com"}'`3. Share as viewer: `gws drive permissions create --params '{"fileId": "FOLDER_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "stakeholder@company.com"}'`4. Verify permissions: `gws drive permissions list --params '{"fileId": "FOLDER_ID"}' --format table`

The Skill explicitly depends on an installed and authorized `gws`/`gws-drive` setup; the supplied material contains no installation script, credential-reading instruction, or other implementation file.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "productivity"    requires:      bins:        - gws      skills:        - gws-drive---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-drive`
Start here · InstructionsSKILL.md
recipe-share-folder-with-team
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
29
File checksum (to compare versions)
5cc89441b0fe4e5a9b8aaf2e0b6b86a7b38111a7394f61961cd6492f03e88823