Skip to content
skillsafebeta
← Report library
Purpose / Documents

Recipe Sync Contacts To Sheet Skill Security Audit

What the author says it does (original text)

Export Google Contacts directory to a Google Sheets spreadsheet.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Organizational email addresses and phone numbers may be exported to a shared or incorrect spreadsheet

Source references: 4
What we found

The command reads names, email addresses, and phone numbers from domain-directory profiles, then appends every contact to an arbitrary `SHEET_ID`. The Skill does not require confirmation that directory export is authorized or check the destination spreadsheet's owner and sharing scope.

Why this matters

If the spreadsheet ID is wrong, externally accessible, or the user is not permitted to export the organizational directory in bulk, contact details for up to the first 100 people may be improperly disclosed.

The recipe explicitly reads names, email addresses, and phone numbers from an organization directory and writes contact rows to a caller-supplied `SHEET_ID`. This can occur only when the executor is authenticated and has the necessary directory and spreadsheet access; the source does not show that any export already occurred. The steps do not require checking the destination owner, sharing scope, or export authorization, so a mistaken or broadly shared sheet could expose organizational contact data. A user can ask for destination/sharing confirmation and restrict directory and Sheets permissions.

SKILL.md:25In the instructionsOpen original file
1. List contacts: `gws people people listDirectoryPeople --params '{"readMask": "names,emailAddresses,phoneNumbers", "sources": ["DIRECTORY_SOURCE_TYPE_DOMAIN_PROFILE"], "pageSize": 100}' --format json`2. Create a sheet: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Name", "Email", "Phone"]'`
Show 3 other places
SKILL.md:26In the instructionsOpen original file
1. List contacts: `gws people people listDirectoryPeople --params '{"readMask": "names,emailAddresses,phoneNumbers", "sources": ["DIRECTORY_SOURCE_TYPE_DOMAIN_PROFILE"], "pageSize": 100}' --format json`2. Create a sheet: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Name", "Email", "Phone"]'`3. Append each contact row: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Jane Doe", "jane@company.com", "+1-555-0100"]'`
SKILL.md:27In the instructionsOpen original file
2. Create a sheet: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Name", "Email", "Phone"]'`3. Append each contact row: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Jane Doe", "jane@company.com", "+1-555-0100"]'`
SKILL.md:21In the instructionsOpen original file
Export Google Contacts directory to a Google Sheets spreadsheet.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill requires two external skills not included in the evidence and uses the `gws` command to access Google People and Sheets. Their actual permissions, data handling, and network behavior therefore cannot be verified from this material.

View source
SKILL.md:19In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-people`, `gws-sheets`

The contact source is explicitly set to domain-directory profiles, reading names, email addresses, and phone numbers. This may represent an organizational directory rather than only the user's personally saved Google contacts. One request retrieves up to 100 entries.

View source
SKILL.md:25In the instructionsOpen original file
1. List contacts: `gws people people listDirectoryPeople --params '{"readMask": "names,emailAddresses,phoneNumbers", "sources": ["DIRECTORY_SOURCE_TYPE_DOMAIN_PROFILE"], "pageSize": 100}' --format json`2. Create a sheet: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Name", "Email", "Phone"]'`

The export target is an existing spreadsheet selected by `SHEET_ID`; the steps write a header and then direct the agent to append contacts row by row. The example does not create a new spreadsheet or show validation of the target spreadsheet's owner or sharing scope.

View source
SKILL.md:26In the instructionsOpen original file
1. List contacts: `gws people people listDirectoryPeople --params '{"readMask": "names,emailAddresses,phoneNumbers", "sources": ["DIRECTORY_SOURCE_TYPE_DOMAIN_PROFILE"], "pageSize": 100}' --format json`2. Create a sheet: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Name", "Email", "Phone"]'`3. Append each contact row: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Jane Doe", "jane@company.com", "+1-555-0100"]'`
SKILL.md:27In the instructionsOpen original file
2. Create a sheet: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Name", "Email", "Phone"]'`3. Append each contact row: `gws sheets +append --spreadsheet SHEET_ID --range 'Contacts' --values '["Jane Doe", "jane@company.com", "+1-555-0100"]'`
Start here · InstructionsSKILL.md
recipe-sync-contacts-to-sheet
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
29
File checksum (to compare versions)
8e9d3c4a663aaa66ba241c1bb6c76c2dd98dcd78d9c76bef0d7f21ba05ea3547