ez-google

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:55 AM UTC
• Version: 1.0.2

Overview

This Google Workspace skill is useful but should be reviewed carefully because it grants broad account access through a third-party OAuth flow and stores long-lived credentials locally.

Install only if you are comfortable granting one broad Google Workspace OAuth credential that can read and modify many services. Prefer the local OAuth flow or your own reviewed OAuth broker, revoke the grant when finished, protect or remove ~/.simple-google-workspace/token.json, avoid pasting tokens into shell history, and treat send, delete, trash, bulk-label, and write commands as actions requiring explicit user review.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/auth.py:24

Finding

Broad Google Workspace authorization is delegated to an unverifiable third-party OAuth service

Content

View full analysis

"') webbrowser.open(login_url) return ``` ```python def save(token: str): """Save token from hosted OAuth.""" CREDS_DIR.mkdir(exist_ok=True) try: # Decode base64 token creds_json = base64.b64decode(token).decode("utf-8") creds_data = json.loads(creds_json) # Validate required fields required = ["token", "refresh_token", "client_id", "client_secret"] missing = [f for f in required if f not in creds_data] if missing: print(f"ERROR: Invalid token (missing: {', '.join(missing)})") sys.exit(1) # Save in google-auth format ...[truncated 3434 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auth.py:121

Finding

Long-lived OAuth credentials are exposed through command-line arguments and insufficiently hardened local storage

Content

View full analysis

' # Save token from hosted OAuth ``` The command-line argument is then decoded and written as plaintext JSON: ```python def save(token: str): """Save token from hosted OAuth.""" CREDS_DIR.mkdir(exist_ok=True) try: # Decode base64 token creds_json = base64.b64decode(token).decode("utf-8") creds_data = json.loads(creds_json) # Validate required fields required = ["token", "refresh_token", "client_id", "client_secret"] missing = [f for f in required if f not in creds_data] if missing: print(f"ERROR: Invalid token (missing: {', '.join(missing)})") sys.exit(1) # Save in google-auth format with open(TOKEN_FILE, "w") as f: json.dump(creds_data, f, indent=2) print("SUCCESS") print(f"Credentials saved to: {TOKEN_FILE}") ``` The CLI reads the sensitive value from `argv`: ```python elif cmd == "save": if len(sys.argv) < 3: print("ERROR: Provide token from OAuth page") sys.exit(1) save(sys.argv[2]) ``` ### Technical Analysis The value passed to `auth.py save` is not an opaque, low-value setup identifier. After Base64 decoding, it must contain an access token, refresh token, OAuth client ID, and client secret. Passing this value as a command-line argument can expose it through: - Shell command history. - Process inspection while the command is running. - Terminal session recording. - Debugging, auditing, ...[truncated 2064 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/auth.py:2

Finding

Runtime dependencies are mutable and lack reproducible integrity controls

Content

View full analysis

=3.10" # dependencies = [ # "google-auth-oauthlib>=1.0.0", # "google-auth>=2.0.0", # ] # /// ``` The service scripts use the same pattern: ```python # /// script # requires-python = ">=3.10" # dependencies = ["google-api-python-client>=2.0.0", "google-auth>=2.0.0", "click>=8.0.0"] # /// ``` ### Technical Analysis The Skill instructs users to run scripts through `uv run`. Each script embeds dependency constraints that permit any future package version satisfying the specified minimum version. No reviewed lockfile, exact version constraints, package hashes, or upper bounds are present in the audited project. Consequently, the dependency code installed and imported at execution time can differ from the code used during this audit. A future compromised, malicious, or incompatible package release could execute with the same local privileges as the Skill. This finding does not establish that the currently named Google or Click packages are malicious. The issue is the absence of controls that make dependency resolution reproducible and verify package integrity. ### Attack Path 1. An attacker compromises an upstream package release, package publishing account, distribution infrastructure, or dependency resolution path. 2. A malicious package version is published while still satisfying the Skill's `>=` constraint. 3. A user invokes a script with `uv run`. 4. The resolver selects and installs the altered package because no exact reviewed version or integrity hash preven ...[truncated 797 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims broad Workspace coverage but the provided content prominently includes destructive Gmail bulk operations that are not clearly declared in the purpose statement. Hidden or underemphasized high-impact actions are dangerous because agents or users may treat the skill as routine productivity tooling while it can perform mass data modification or deletion.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims broad Workspace coverage but the provided content prominently includes destructive Gmail bulk operations that are not clearly declared in the purpose statement. Hidden or underemphasized high-impact actions are dangerous because agents or users may treat the skill as routine productivity tooling while it can perform mass data modification or deletion.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 52)May include surrounding context.

python

CREDS_DIR = Path.home() / ".simple-google-workspace"
TOKEN_FILE = CREDS_DIR / "token.json"
CLIENT_SECRETS_FILE = CREDS_DIR / "client_secrets.json"
FLOW_STATE_FILE = CREDS_DIR / "flow_state.json"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill exposes capabilities that can access environment data, write files, and make network requests, but it does not declare any explicit tool scope or permissions boundaries. In a highly privileged Google Workspace skill, this omission makes it harder for a host agent or reviewer to constrain what the skill may do and increases the risk of unintended data access or exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is extremely broad and can match many everyday requests involving email, documents, scheduling, and contacts. Overbroad routing increases the chance this high-privilege skill is selected unnecessarily, exposing sensitive Workspace data or enabling actions in situations where a narrower or read-only tool would be safer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation presents destructive and data-modifying operations such as bulk labeling and bulk trashing of up to 1000 messages per API call without strong warnings about consequences. In a mailbox context, this can lead to large-scale accidental or induced data loss, hiding of important mail, or workflow disruption, especially when queries are broad or mistaken.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The -y option explicitly allows skipping confirmation for bulk trash operations, enabling autonomous destructive actions against a user's mailbox. In an agent setting, confirmation bypass materially increases the risk of prompt-induced or mistaken mass deletion without meaningful human review.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Bulk operations (up to 1000 messages per API call)

gmail.py bulk-label "query" --add LABEL --remove LABEL # Add/remove labels gmail.py bulk-trash "query" [-y] # Move to trash (use -y to skip confirmation)

text

**Bulk examples:**

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description omits Google Chat capabilities even though the documentation exposes listing spaces, reading messages, and sending messages. This under-disclosure is risky because Chat content may be sensitive, and users or agent frameworks may authorize or invoke the skill without realizing it can access and post to chats.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default login path sends users to a third-party hosted OAuth service at ezagentauth.com, which can observe or handle highly sensitive OAuth artifacts, including authorization codes or token material, yet the script provides no explicit trust boundary warning. Because this skill is designed for broad Google Workspace access with offline refresh tokens, using an external broker materially increases the risk of credential interception, misuse, or account-wide data access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The OAuth helper requests Google Chat scopes that are not described in the skill metadata, creating a scope mismatch between what users expect and what the code can access. In an agent-oriented integration, undeclared scopes are dangerous because they expand the reachable data/actions surface beyond documented functionality and undermine informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script stores OAuth credentials, including refresh tokens and client secrets, in plaintext JSON under the user's home directory without setting restrictive permissions or warning about persistence. If the local machine is shared, backed up insecurely, or compromised by other processes, these tokens can be reused to access Gmail, Drive, Calendar, and other Google Workspace data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements Google Chat capabilities (listing spaces, reading messages, sending messages, and retrieving space details) even though the declared skill description does not mention Chat. This creates a scope mismatch that can expose additional communication data and outbound messaging functionality to users or agents who reasonably expect access only to Gmail, Calendar, Drive, Docs, Sheets, Slides, and Contacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The send command transmits email immediately using provided arguments without any confirmation, preview, or policy check. In an agent setting, this makes unintended outbound communication easy if the model is manipulated by prompt injection, misunderstands user intent, or is induced to exfiltrate data via email.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file exposes high-impact bulk mailbox operations, including bulk labeling and trashing based on arbitrary Gmail queries, which materially increases the action surface beyond simple read/send workflows. In an agent-integrated context, these commands enable large-scale destructive or state-changing actions with minimal friction, so prompt injection, user misunderstanding, or agent misuse could cause widespread mailbox modification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/gmail.py (reported line 242)May include surrounding context.

python

@cli.command("bulk-trash")
@click.argument("query")
@click.option("--max", "-n", "max_results", type=int, help="Max messages to trash")
@click.option("--yes", "-y", is_flag=True, help="Skip confirmation prompt")
def bulk_trash(query: str, max_results: int | None, yes: bool):
    """Trash all messages matching a query.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script retrieves and prints profile and contact data including names, email addresses, phone numbers, organizations, and addresses directly to stdout with no user-facing sensitivity warning, output minimization, or confirmation step. In an agent skill context, that increases the risk of unintentional disclosure of personal data to logs, downstream tools, transcripts, or unauthorized requesters, especially because the skill is explicitly designed to access Google contacts and profile data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Both service-construction helpers load credentials from ~/.simple-google-workspace/token.json, which is sensitive authentication material. The file includes no warning, log message, or explanatory comment disclosing that stored OAuth credentials are accessed for these commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The move command performs a state-changing Drive update that removes existing parents and adds a new folder, which can affect document organization and access expectations. While it prints a success message afterward, there is no prior confirmation, warning comment, or other disclosure around this potentially disruptive operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code performs a network call to Google Drive using the user's credentials and sends the user-supplied query to an external service, but there is no confirmation prompt, comment, or user-facing disclosure explaining that remote data access occurs. Because this is a code file, network operations that transmit user or system data should have some visible warning unless clearly disclosed elsewhere in the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The text command retrieves full presentation contents from Google Slides and prints them to stdout, which may expose potentially sensitive document data, yet the code provides no warning or disclosure about this behavior. Under the code-file criteria, network retrieval and output of user data should have some visible explanation when no other warning is present in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.