Recipe Generate Report From Sheet

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:43 AM UTC
• Version: 1.0.13

Overview

This recipe is mostly coherent, but it instructs the agent to share generated business reports with a fixed email address without user confirmation.

Review before installing or using. Replace the fixed recipient with a user-supplied stakeholder address and confirm the document ID, recipient, and reader role before running the Drive permissions command. Generating the report itself is low risk compared with the sharing step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Hard-Coded Recipient May Receive Unauthorized Access to Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:37
Vulnerability Type: Hard-coded document-sharing recipient
Risk Level: Medium

Vulnerable Code

sh

4. Share with stakeholders: `gws drive permissions create --params '{"fileId": "DOC_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "[e-mail]"}'`

Technical Analysis

The recipe directs the agent to grant a hard-coded email address reader access to the generated Google document. Sharing is performed without requiring user confirmation or verifying that [e-mail] is an authorized recipient for the current organization, source spreadsheet, or report.

This behavior exceeds the core report-generation operations of reading spreadsheet data and creating a document. Because the report may contain business information derived from a Google Sheet, automatically granting access to a fixed account can cause unauthorized disclosure when the recipe is used outside the environment for which that address was intended.

Attack Path

1. A user invokes the recipe to produce a report from a Google Sheet.
2. The agent reads spreadsheet data that may contain confidential business information.
3. The agent creates and populates a Google document with that information.
4. Following the final recipe step, the agent invokes the Google Drive permissions API.
5. Reader access is granted to the hard-coded [e-mail] account without recipient validation or user confirmation.
6. If that account is not authorized for the user's data, its owner can access the generated report.

Impact Assessment

The recipient obtains reader access to the generated Google document. This does not grant broader system or Google Drive privileges, but it can expose all information included in that report, such as sales figures, revenue data, customer names, and other spreadsheet-derived content. The scope is limited to documents shared through this instr ...[truncated 87 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic sharing from the default report-generation workflow.
• Replace the hard-coded address with an explicit parameter such as STAKEHOLDER_EMAIL.
• Require the user to confirm the exact recipient address and permission role immediately before creating the permission.
• Validate that the recipient belongs to an approved domain or allowlist where organizational policy requires it.
• Display the target document ID, recipient, and access level for review before executing the sharing command.
• Apply least privilege by using reader access unless the user explicitly requests and authorizes a stronger role.
• Permit report generation to complete without sharing when no authorized recipient is supplied.
• Record or return the resulting permission details so the user can verify and revoke access if necessary.

A hardened example should use a user-supplied, validated value rather than a fixed account:

sh

gws drive permissions create \
  --params '{"fileId": "DOC_ID"}' \
  --json '{"role": "reader", "type": "user", "emailAddress": "STAKEHOLDER_EMAIL"}'

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly shares the generated Google Doc with a hardcoded external recipient email address and provides no user-facing warning, confirmation, or scope limitation around disclosing spreadsheet-derived data. In a productivity/reporting context, sheet data may contain sensitive business or personal information, so automatic sharing can cause unintended data exposure to unauthorized parties.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.