Recipe Review Overdue Tasks

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may see task-list names and incomplete task details, including due dates, for the configured Google account.

Why it was flagged

These commands access Google Tasks through the local gws setup. That is purpose-aligned, but it uses the privileges of whichever Google account/profile gws is configured to use.

Skill content

List task lists: `gws tasks tasklists list --format table`; List tasks with status: `gws tasks tasks list --params '{"tasklist": "TASKLIST_ID", "showCompleted": false}' --format table`

Recommendation

Use this only with a trusted gws configuration for the intended Google account, and confirm you are comfortable exposing those tasks to the agent.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the local gws tool or gws-tasks skill is untrusted or misconfigured, the actual account access may differ from what this simple recipe describes.

Why it was flagged

The recipe depends on preinstalled external tooling and a companion skill. The recipe itself does not install code, but its behavior depends on those components being legitimate.

Skill content

requires:
  bins:
    - gws
  skills:
    - gws-tasks

Recommendation

Keep gws and gws-tasks installed from trusted sources and review their permissions before using this recipe.