Recipe Log Deal Update

PassAudited by ClawScan on May 10, 2026.

Overview

This is a narrow Google Sheets recipe that can read and append to a sales spreadsheet, which matches its stated purpose but should be run with the correct Google account and row values.

Before installing or running, make sure gws is logged into the correct Google account, confirm the Sales Pipeline spreadsheet is the intended one, and replace the sample row values with the actual deal update.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If run with the wrong sheet ID or placeholder values, it could add inaccurate information to the sales tracker.

Why it was flagged

The skill instructs use of a tool command that modifies a Google Sheet. This is expected for the stated purpose, but it is still a write action against business data.

Skill content

Append new row: `gws sheets +append --spreadsheet SHEET_ID --range 'Pipeline' --values '["2024-03-15", "Acme Corp", "Proposal Sent", "$50,000", "Q2", "jdoe"]'`

Recommendation

Confirm the target spreadsheet and row values before allowing the append command to run.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill may be able to list matching Drive files, read the target sheet, and append rows using the authenticated Google account.

Why it was flagged

The skill relies on Google Workspace tooling and related Drive/Sheets skills, which means it will operate using whatever Google account and permissions are configured for gws.

Skill content

requires:
      bins:
        - gws
      skills:
        - gws-sheets
        - gws-drive

Recommendation

Use an appropriate Google account with least-privilege access to the intended spreadsheet, and verify that gws is authenticated to the right account.