Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Watch Drive Changes Skill Security Audit

What the author says it does (original text)

Subscribe to change notifications on a Google Drive file or folder.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The command watches an entire Drive rather than the claimed file or folder and sends resource data to Pub/Sub

Source references: 2
What we found

The description claims a subscription on a Drive file or folder, but the actual `targetResource` is `drives/DRIVE_ID`. In addition, `includeResource: true` places resource data in events sent to the specified Pub/Sub topic.

Why this matters

A user expecting one-file or one-folder monitoring may collect update information across a broader Drive scope. If the topic is mistyped, third-party-controlled, or broadly accessible, unintended recipients may receive that event data.

The description promises a file-or-folder watch, but the command targets `//drive.googleapis.com/drives/DRIVE_ID`, potentially covering updates at Drive scope rather than one item. With `includeResource` enabled, resource data is included in notifications sent to the supplied Pub/Sub topic; a wrong Drive ID or topic could broaden disclosure. Users can ask the author to document the supported resource granularity and restrict use to a verified Drive, Cloud project, and topic.

SKILL.md:20In the instructionsOpen original file
Subscribe to change notifications on a Google Drive file or folder.
Show 1 other places
SKILL.md:24In the instructionsOpen original file
1. Create subscription: `gws events subscriptions create --json '{"targetResource": "//drive.googleapis.com/drives/DRIVE_ID", "eventTypes": ["google.workspace.drive.file.v1.updated"], "notificationEndpoint": {"pubsubTopic": "projects/PROJECT/topics/TOPIC"}, "payloadOptions": {"includeResource": true}}'`2. List active subscriptions: `gws events subscriptions list`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The subscription creates renewable ongoing monitoring without a scope-confirmation or cancellation step

Source references: 2
What we found

The workflow directly creates a subscription and instructs renewal before expiry, but supplies no cancellation step and requests no confirmation of the account, Drive, notification topic, or intended duration before creation or renewal.

Why this matters

If automated, run under the wrong account, or given the wrong subscription ID, Drive activity notifications may continue reaching the topic after the user expected monitoring to end and may keep consuming associated Workspace/Cloud resources.

The steps create a subscription and explicitly direct renewal before expiry, so performing renewal extends monitoring. The complete procedure only covers create, list, and renew; it provides no stop method or check of the account, Drive, Pub/Sub topic, or intended duration. Creation is consistent with the stated purpose, but mistaken configuration or unnecessary renewal could keep notifications flowing. Users can ask for expiry/cancellation guidance and confirmation of scope and destination before creation or renewal.

SKILL.md:24In the instructionsOpen original file
1. Create subscription: `gws events subscriptions create --json '{"targetResource": "//drive.googleapis.com/drives/DRIVE_ID", "eventTypes": ["google.workspace.drive.file.v1.updated"], "notificationEndpoint": {"pubsubTopic": "projects/PROJECT/topics/TOPIC"}, "payloadOptions": {"includeResource": true}}'`2. List active subscriptions: `gws events subscriptions list`3. Renew before expiry: `gws events +renew --subscription SUBSCRIPTION_ID`
Show 1 other places
SKILL.md:22In the instructionsOpen original file
## Steps1. Create subscription: `gws events subscriptions create --json '{"targetResource": "//drive.googleapis.com/drives/DRIVE_ID", "eventTypes": ["google.workspace.drive.file.v1.updated"], "notificationEndpoint": {"pubsubTopic": "projects/PROJECT/topics/TOPIC"}, "payloadOptions": {"includeResource": true}}'`2. List active subscriptions: `gws events subscriptions list`3. Renew before expiry: `gws events +renew --subscription SUBSCRIPTION_ID`
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill requires `gws` and `gws-events`, then uses Google Workspace Events to create, list, and renew subscriptions. The supplied material does not include the implementation of `gws-events`, so its internal behavior cannot be determined from these lines.

View source
SKILL.md:9In the instructionsOpen original file
    domain: "engineering"    requires:      bins:        - gws      skills:        - gws-events---
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-events`

The creation command sends notifications to a user-supplied Google Cloud Pub/Sub topic and requests resource data in each event payload.

View source
SKILL.md:24In the instructionsOpen original file
1. Create subscription: `gws events subscriptions create --json '{"targetResource": "//drive.googleapis.com/drives/DRIVE_ID", "eventTypes": ["google.workspace.drive.file.v1.updated"], "notificationEndpoint": {"pubsubTopic": "projects/PROJECT/topics/TOPIC"}, "payloadOptions": {"includeResource": true}}'`2. List active subscriptions: `gws events subscriptions list`

The workflow lists existing subscriptions and provides a subscription-ID renewal step, allowing monitoring to continue beyond the initial validity period.

View source
SKILL.md:25In the instructionsOpen original file
1. Create subscription: `gws events subscriptions create --json '{"targetResource": "//drive.googleapis.com/drives/DRIVE_ID", "eventTypes": ["google.workspace.drive.file.v1.updated"], "notificationEndpoint": {"pubsubTopic": "projects/PROJECT/topics/TOPIC"}, "payloadOptions": {"includeResource": true}}'`2. List active subscriptions: `gws events subscriptions list`3. Renew before expiry: `gws events +renew --subscription SUBSCRIPTION_ID`
Start here · InstructionsSKILL.md
recipe-watch-drive-changes
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
f56f145d62ccdbcaefbaf5272ce3b30c2f12f6609735527717a613a33eaf4f26