跳转到正文
skillsafebeta
← 报告库
用途分类 / 文档处理

Gws Sheets Skill 安全审计

作者说它能做什么（原文）

Google Sheets: Read and write spreadsheets.

第三方安全检查结论

这次检查未发现明显风险

已检查文件
1
发现的风险
0
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

3 个说明模块

该技能是 Google Sheets 的命令行接口说明，声明可读取和写入电子表格，并要求系统中已有 `gws` 可执行文件。

查看原文
SKILL.md:3来自说明文档打开原文件
name: gws-sheetsdescription: "Google Sheets: Read and write spreadsheets."metadata:
SKILL.md:8来自说明文档打开原文件
    category: "productivity"    requires:      bins:        - gws    cliHelp: "gws sheets --help"
SKILL.md:18来自说明文档打开原文件
```bashgws sheets <resource> <method> [flags]```

它提供读取、追加、创建和批量更新表格的入口；其中创建和批量更新会改变用户的 Google Sheets 数据，但这些能力与其声明的读写用途一致。

查看原文
SKILL.md:26来自说明文档打开原文件
|---------|-------------|| [`+append`](../gws-sheets-append/SKILL.md) | Append a row to a spreadsheet || [`+read`](../gws-sheets-read/SKILL.md) | Read values from a spreadsheet |
SKILL.md:33来自说明文档打开原文件
  - `batchUpdate` — Applies one or more updates to the spreadsheet. Each request is validated before being applied. If any request is not valid then the entire request will fail and nothing will be applied. Some requests have replies to give you some information about how they are applied. The replies will mirror the requests. For example, if you applied 4 updates and the 3rd one had a reply, then the response will have 2 empty replies, the actual reply, and another empty reply, in that order.  - `create` — Creates a spreadsheet, returning the newly created spreadsheet.  - `get` — Returns the spreadsheet at the given ID. The caller must specify the spreadsheet ID. By default, data within grids is not returned. You can include grid data in one of 2 ways: * Specify a [field mask](https://developers.google.com/workspace/sheets/api/guides/field-masks) listing your desired fields using the `fields` URL parameter in HTTP * Set the includeGridData URL parameter to true.

认证、全局参数和安全规则并未包含在所提供源码中，而是委托给相邻的共享技能；如果该文件缺失，说明会运行生成技能文件的命令。因此，仅凭本次材料无法审查实际认证和安全约束。

查看原文
SKILL.md:16来自说明文档打开原文件
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.

在调用 API 方法前，该技能要求先查看命令帮助和方法架构，再据此构造参数。

查看原文
SKILL.md:43来自说明文档打开原文件
Before calling any API method, inspect it:```bash# Browse resources and methodsgws sheets --help# Inspect a method's required params, types, and defaultsgws schema sheets.<resource>.<method>```
SKILL.md:53来自说明文档打开原文件
Use `gws schema` output to build your `--params` and `--json` flags.
从这里开始 · 工作说明SKILL.md
gws-sheets
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

运行命令
SKILL.md:18来自说明文档打开原文件
```bashgws sheets <resource> <method> [flags]
SKILL.md:45来自说明文档打开原文件
```bash# Browse resources and methods
连接外部网站
SKILL.md:33来自说明文档打开原文件
  - `batchUpdate` — Applies one or more updates to the spreadsheet. Each request is validated before being applied. If any request is not valid then the entire request will fail and nothing will be applied. Some requests have replies to give you some information about how they are applied. The replies will mirror the requests. For example, if you applied 4 updates and the 3rd one had a reply, then the response will have 2 empty replies, the actual reply, and another empty reply, in that order.  - `create` — Creates a spreadsheet, returning the newly created spreadsheet.
SKILL.md:35来自说明文档打开原文件
  - `create` — Creates a spreadsheet, returning the newly created spreadsheet.  - `get` — Returns the spreadsheet at the given ID. The caller must specify the spreadsheet ID. By default, data within grids is not returned. You can include grid data in one of 2 ways: * Specify a [field mask](https://developers.google.com/workspace/sheets/api/guides/field-masks) listing your desired fields using the `fields` URL parameter in HTTP * Set the includeGridData URL parameter to true.  - `getByDataFilter` — Returns the spreadsheet at the given ID. The caller must specify the spreadsheet ID. For more information, see [Read, write, and search metadata](https://developers.google.com/workspace/sheets/api/guides/metadata). T …
SKILL.md:36来自说明文档打开原文件
  - `get` — Returns the spreadsheet at the given ID. The caller must specify the spreadsheet ID. By default, data within grids is not returned. You can include grid data in one of 2 ways: * Specify a [field mask](https://developers.google.c …  - `getByDataFilter` — Returns the spreadsheet at the given ID. The caller must specify the spreadsheet ID. For more information, see [Read, write, and search metadata](https://developers.google.com/workspace/sheets/api/guides/metadata). This method differs from GetSpreadsheet in that it allows selecting which subsets of spreadsheet data to return by specifying a dataFilters parameter. Multiple DataFilters can be specified.  - `developerMetadata` — Operations on the 'developerMetadata' resource
读取了多少行
55
文件校验值（用于核对版本）
2c7969cf753700aa63f4dd3d334e9751ff781363896fc91a65d0b3f2c0f17e9f