Recipe Log Deal Update

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If run with the wrong sheet ID or placeholder values, it could add inaccurate information to the sales tracker.

Why it was flagged

The skill instructs use of a tool command that modifies a Google Sheet. This is expected for the stated purpose, but it is still a write action against business data.

Skill content

Append new row: `gws sheets +append --spreadsheet SHEET_ID --range 'Pipeline' --values '["2024-03-15", "Acme Corp", "Proposal Sent", "$50,000", "Q2", "jdoe"]'`

Recommendation

Confirm the target spreadsheet and row values before allowing the append command to run.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill may be able to list matching Drive files, read the target sheet, and append rows using the authenticated Google account.

Why it was flagged

The skill relies on Google Workspace tooling and related Drive/Sheets skills, which means it will operate using whatever Google account and permissions are configured for gws.

Skill content

requires:
      bins:
        - gws
      skills:
        - gws-sheets
        - gws-drive

Recommendation

Use an appropriate Google account with least-privilege access to the intended spreadsheet, and verify that gws is authenticated to the right account.