Gws Workflow File Announce

Google Workflow: Announce a Drive file in a Chat space.

Security Scan

The skill's stated behavior (announcing a Drive file to Chat) matches the single required binary (gws), but it hides critical auth/credential requirements behind a referenced shared doc (../gws-shared/SKILL.md) and does not declare what credentials or scopes it needs.

Purpose & Capability

Name/description match the requested binary 'gws' and the command shown. However, the skill defers authentication and global flags to ../gws-shared/SKILL.md — those unstated dependencies likely include Drive read and Chat write credentials that are not declared here. The binary requirement is reasonable for the stated purpose but the external auth dependency is not surfaced in the skill metadata.

Instruction Scope

The SKILL.md instructs the agent to run a single gws workflow command that fetches a Drive file name and sends a Chat message. The runtime instructions themselves stay within the announced scope, but they explicitly require the agent to consult ../gws-shared/SKILL.md for auth, global flags, and security rules — meaning the actual runtime behavior depends on another file not included or declared, which hides the full instruction surface.

Install Mechanism

No install spec and no code files (instruction-only), which minimizes on-disk risk. The skill only requires the 'gws' binary to be present; there is no download/extract behavior in this package.

Credentials

The skill declares no environment variables or primary credential, yet it is a write operation (posts chat messages) and needs to read Drive metadata. Those credentials/scopes are likely required but are hidden in the referenced ../gws-shared/SKILL.md. Hiding required credentials in an external doc makes it hard to evaluate whether the skill requests excessive or unrelated secrets.

Persistence & Privilege

always is false and the skill is user-invocable only; it does not request persistent/system-wide changes. Autonomous invocation is allowed by default but is not combined with elevated privileges here.

What to consider before installing

This skill itself is a small wrapper that calls the 'gws' CLI to announce a Drive file to a Chat space, but it defers authentication and security rules to ../gws-shared/SKILL.md which is not included. Before installing or using this skill: (1) inspect the referenced gws-shared SKILL.md to see exactly what credentials (Google OAuth client, service account, environment vars, token files) and scopes are required and where they are stored; (2) verify the origin and trustworthiness of the 'gws' CLI binary on your system (who installed it, is it an official release); (3) ensure the required scopes are minimal (Drive read and Chat write only) and that no unrelated credentials are being requested; (4) be aware this skill will send messages into Chat spaces (possible spam/exfil vectors) so confirm the target space IDs and message content handling; and (5) if you cannot review gws-shared or the gws CLI source, treat this skill as risky and avoid granting it credentials.

workflow +file-announce

PREREQUISITE: Read ../gws-shared/SKILL.md for auth, global flags, and security rules. If missing, run gws generate-skills to create it.

Announce a Drive file in a Chat space

Usage

gws workflow +file-announce --file-id <ID> --space <SPACE>

Flags

Flag	Required	Default	Description
--file-id	✓	—	Drive file ID to announce
--space	✓	—	Chat space name (e.g. spaces/SPACE_ID)
--message	—	—	Custom announcement message
--format	—	—	Output format: json (default), table, yaml, csv

Examples

gws workflow +file-announce --file-id FILE_ID --space spaces/ABC123
gws workflow +file-announce --file-id FILE_ID --space spaces/ABC123 --message 'Check this out!'

Tips

• This is a write command — sends a Chat message.
• Use gws drive +upload first to upload the file, then announce it here.
• Fetches the file name from Drive to build the announcement.

See Also

• gws-shared — Global flags and auth
• gws-workflow — All cross-service productivity workflows commands