Envato Comment → Task → Google Sheet

• Outcome: Pass
• Latest audit: May 28, 2026 at 7:54 AM UTC
• Version:
  1.0.0

Overview

This skill is a simple, non-executable workflow that turns Envato comments into structured task JSON for a user-managed Google Sheet.

Install if you are comfortable processing Envato comment text and product URLs into a Google Sheet. Use a Google Apps Script endpoint you control, restrict sheet access, and avoid sending sensitive customer or business data unless that storage location is approved.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly instructs users to send the skill's JSON output to an external Apps Script webhook, but provides no warning about what data may be transmitted, who controls the endpoint, or the privacy/security implications of exporting potentially sensitive task content. In a workflow that processes comments, URLs, classifications, severity, and customer risk fields, this can lead to unintended exfiltration of user or business-sensitive data to a third-party service.

VirusTotal

66/66 vendors flagged this skill as clean.