跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Gws Events Skill 安全审计

作者说它能做什么（原文）

Subscribe to Google Workspace events.

第三方安全检查结论

发现低风险问题

已检查文件
1
发现的风险
1
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。发现 1 项风险
低风险

缺少共享前置文件时会运行生成命令并写入本地技能文件

原文依据：1 处
发现了什么

该技能明确要求在 `../gws-shared/SKILL.md` 缺失时执行 `gws generate-skills`。这是在订阅事件之外的本地持久化操作，且提供的材料没有展示将生成哪些文件或内容。

为什么需要注意

使用技能可能在相邻技能目录创建或更新文件；生成的认证和安全指令随后会影响代理如何使用 Google 账户，但本次审计无法核实这些指令。

这是生效的前置指令：当共享技能文件不存在时，代理会运行生成命令。文字明确表示该命令会创建文件，因此可能在本地技能目录产生持久化变更；但材料没有说明完整的写入范围、是否覆盖现有文件或生成内容。用户可要求作者列出该命令的确切输出路径和覆盖规则，或限制代理只读取现有文件并在缺失时停止。

SKILL.md:16来自说明文档打开原文件
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

3 个说明模块

该技能是 Google Workspace Events 的命令参考，要求通过 `gws events <resource> <method>` 调用，并要求每次调用 API 方法前先查看帮助和方法架构。

查看原文
SKILL.md:18来自说明文档打开原文件
```bashgws events <resource> <method> [flags]```
SKILL.md:57来自说明文档打开原文件
Before calling any API method, inspect it:```bash# Browse resources and methodsgws events --help# Inspect a method's required params, types, and defaultsgws schema events.<resource>.<method>```Use `gws schema` output to build your `--params` and `--json` flags.

所列接口不仅能订阅和读取事件，也包含会改变 Google Workspace 外部状态的操作，例如创建、删除、更新、续订和重新激活订阅，以及取消代理任务。这些行是能力说明，并未直接要求执行。

查看原文
SKILL.md:41来自说明文档打开原文件
  - `create` — Creates a Google Workspace subscription. To learn how to use this method, see [Create a Google Workspace subscription](https://developers.google.com/workspace/events/guides/create-subscription).  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).  - `get` — Gets details about a Google Workspace subscription. To learn how to use this method, see [Get details about a Google Workspace subscription](https://developers.google.com/workspace/events/guides/get-subscription).  - `list` — Lists Google Workspace subscriptions. To learn how to use this method, see [List Google Workspace subscriptions](https://developers.google.com/workspace/events/guides/list-subscriptions).  - `patch` — Updates or renews a Google Workspace subscription. To learn how to use this method, see [Update or renew a Google Workspace subscription](https://developers.google.com/workspace/events/guides/update-subscription).  - `reactivate` — Reactivates a suspended Google Workspace subscription. This method resets your subscription's `State` field to `ACTIVE`. Before you use this method, you must fix the error that suspended the subscription. This method will ignore or reject any subscription that isn't currently in a suspended state. To learn how to use this method, see [Reactivate a Google Workspace subscription](https://developers.google.com/workspace/events/guides/reactivate-subscription).
SKILL.md:50来自说明文档打开原文件
  - `cancel` — Cancel a task from the agent. If supported one should expect no more task updates for the task.  - `get` — Get the current state of a task from the agent.  - `subscribe` — TaskSubscription is a streaming call that will return a stream of task update events. This attaches the stream to an existing in process task. If the task is complete the stream will return the completed task (like GetTask) and close the stream.  - `pushNotificationConfigs` — Operations on the 'pushNotificationConfigs' resource

该技能依赖一个未包含在所提供源码中的共享技能来规定认证、全局参数和安全规则；若该文件不存在，它指示运行生成命令创建该文件。因此，本次材料无法核实实际认证范围或生成内容。

查看原文
SKILL.md:16来自说明文档打开原文件
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
从这里开始 · 工作说明SKILL.md
gws-events
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

运行命令
SKILL.md:18来自说明文档打开原文件
```bashgws events <resource> <method> [flags]
SKILL.md:59来自说明文档打开原文件
```bash# Browse resources and methods
连接外部网站
SKILL.md:41来自说明文档打开原文件
  - `create` — Creates a Google Workspace subscription. To learn how to use this method, see [Create a Google Workspace subscription](https://developers.google.com/workspace/events/guides/create-subscription).  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).
SKILL.md:42来自说明文档打开原文件
  - `create` — Creates a Google Workspace subscription. To learn how to use this method, see [Create a Google Workspace subscription](https://developers.google.com/workspace/events/guides/create-subscription).  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).  - `get` — Gets details about a Google Workspace subscription. To learn how to use this method, see [Get details about a Google Workspace subscription](https://developers.google.com/workspace/events/guides/get-subscription).
SKILL.md:43来自说明文档打开原文件
  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).  - `get` — Gets details about a Google Workspace subscription. To learn how to use this method, see [Get details about a Google Workspace subscription](https://developers.google.com/workspace/events/guides/get-subscription).  - `list` — Lists Google Workspace subscriptions. To learn how to use this method, see [List Google Workspace subscriptions](https://developers.google.com/workspace/events/guides/list-subscriptions).
读取了多少行
69
文件校验值（用于核对版本）
62a1c6ff7bd74a33ebc4376724116ccdb63aca01689c1b3740365f46e8a5e9bb