recipe-create-events-from-sheet
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that reads content from an external Google Sheets spreadsheet and uses that data to create entries in a Google Calendar. This ingestion of untrusted external data represents a potential indirect prompt injection surface.
- Ingestion points: The
gws sheets +readcommand inSKILL.mdretrieves data from a spreadsheet ID. - Boundary markers: The instructions do not define delimiters or provide specific warnings to the agent to ignore instructions embedded within the spreadsheet data.
- Capability inventory: The skill utilizes the
gws calendar +insertcapability to write data to an external service. - Sanitization: There is no mention of sanitization, validation, or escaping of the spreadsheet data before it is interpolated into the calendar insertion command.
Audit Metadata