Recipe Copy Sheet For New Month

Duplicate a Google Sheets template tab for a new month of tracking.

Security Scan

The recipe's high-level purpose (duplicate a Google Sheets tab) matches the tools it calls, but the runtime instructions are incomplete and contain hard-coded values that make them unreliable or unsafe to run as-is.

Purpose & Capability

Name/description align with required binary (gws) and dependency on gws-sheets — those are the expected tools for Google Sheets operations. No unrelated binaries or credentials are requested by this recipe itself.

Instruction Scope

The SKILL.md steps are incomplete and brittle: step 2 (copyTo) does not instruct the agent to capture the response to obtain the new sheetId, but step 3 uses a hard-coded sheetId (123) and a hard-coded title ('February 2025'). There are no instructions to authenticate or ensure gws is configured, no parameterization for the target month or template sheetId, and no error-handling guidance. This grants the agent broad discretion to run destructive operations on whatever SHEET_ID is supplied.

Install Mechanism

Instruction-only skill with no install spec and no files to write. This is low-risk from an install standpoint.

Credentials

The skill declares no environment variables or credentials itself, which is plausible because it relies on an external 'gws-sheets' skill and the gws binary to handle auth. However, the recipe fails to mention or require authentication steps or credential scoping — users must ensure gws is authenticated (OAuth/service account) and permissions are least-privilege. The lack of explicit credential guidance is a missing but explainable omission.

Persistence & Privilege

always is false and the skill is user-invocable only. It does not request persistent or elevated platform privileges.

What to consider before installing

This recipe is coherent at a high level but has important gaps and brittle hard-coded values. Before using it: (1) ensure the gws CLI is installed and authenticated for the Google account or service account that owns the spreadsheet; (2) do not run the commands against production spreadsheets until tested on a copy; (3) update the SKILL.md to capture and use the new sheetId returned by the copyTo call (the copy response contains the new sheetId), and parameterize the new tab title (month/year) instead of hard-coding 'February 2025' and sheetId 123; (4) confirm gws-sheets dependency handles auth and has least-privilege access; and (5) add error handling and validation to prevent accidental overwrites. These changes would remove the primary concerns.

Copy a Google Sheet for a New Month

PREREQUISITE: Load the following skills to execute this recipe: gws-sheets

Duplicate a Google Sheets template tab for a new month of tracking.

Steps

1. Get spreadsheet details: gws sheets spreadsheets get --params '{"spreadsheetId": "SHEET_ID"}'
2. Copy the template sheet: gws sheets spreadsheets sheets copyTo --params '{"spreadsheetId": "SHEET_ID", "sheetId": 0}' --json '{"destinationSpreadsheetId": "SHEET_ID"}'
3. Rename the new tab: gws sheets spreadsheets batchUpdate --params '{"spreadsheetId": "SHEET_ID"}' --json '{"requests": [{"updateSheetProperties": {"properties": {"sheetId": 123, "title": "February 2025"}, "fields": "title"}}]}'