T09 · Insecure Skill Coding Practices
Error
- Location
skill.py:195- Finding
Unrestricted Local File Upload to Google Drive
- Content
View full analysis
- Remediation
View remediation
Security audit
Google Suite Skill
Security checks for vulnerabilities and agentic risk
Overview
This Google integration is mostly coherent, but it grants broad read/write/delete access to Gmail, Calendar, Drive, and local files without enough safeguards.
Install only if you are comfortable granting this skill broad ongoing access to your Gmail, Calendar, Drive, and local files. Use a dedicated Google account or least-privilege OAuth app where possible, review each destructive action before invoking it, avoid uploading sensitive local paths, restrict download destinations manually, and revoke/delete google_suite_tokens.json if you no longer trust the environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
skill.py:204- Finding
Arbitrary Local File Creation and Overwrite During Drive Download
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:58- Finding
OAuth Refresh Credentials Stored in an Unprotected Plaintext File
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded Dependency Versions and Non-Reproducible Installation
- Content
View full analysis
=2.0.0 google-auth-httplib2>=0.1.0 google-auth-oauthlib>=0.4.0 ``` The installation instructions further request unconditional upgrades: ```bash pip install --upgrade google-api-python-client google-auth-httplib2 google-auth-oauthlib ``` ### Technical Analysis Every dependency uses an open-ended lower bound, allowing the installer to select any future release. No lockfile or cryptographic integrity hashes are supplied. The documented `--upgrade` command further encourages replacing reviewed versions with the newest available packages. The package names are consistent with the declared Google integration, and the audit found no evidence of typo-squatting, dependency confusion, or an intentionally malicious package. The risk is that deployments are non-reproducible and automatically trust future package releases and dependency trees that were not part of this review. ### Attack Path 1. A user installs the skill or follows the documented upgrade command. 2. The package resolver selects the latest releases satisfying the broad lower bounds. 3. A future compromised, malicious, or unexpectedly incompatible release is downloaded from the configured package index. 4. Dependency code executes during installation, import, authentication, or API operations. 5. That code runs with the privileges and data access of the skill process, including potential access to OAuth credentials and local files. ### Impact Assessment Impact depends on the behavior of an affected dependency release. A compromised dependency could execute code under the skill process identity, access local data available to that process, intercept OAuth credentials, or manipulate Google API requests. No presently maliciou ...[truncated 158 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ] TOKEN_PATH = Path(__file__).parent / 'google_suite_tokens.json' CREDENTIALS_PATH = Path(__file__).parent / 'google_suite_credentials.json' def get_skill_info():
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This function deletes Gmail messages, which is a destructive operation, but it executes immediately with no confirmation prompt, warning, or user-visible disclosure. The file-level description is too general to count as a warning about destructive mailbox changes.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Deleting calendar events is a destructive action that can affect user data and scheduling integrity. The implementation performs the delete directly with no confirmation step and no user-facing disclosure in the code or skill description.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This function deletes files from Google Drive, which is an irreversible or destructive user-data operation. It proceeds with no confirmation prompt, warning, or explicit user-facing disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises destructive capabilities across Gmail, Calendar, and Drive, including deleting emails, deleting events, and deleting files, but provides no explicit warning, confirmation, or approval guidance for high-impact actions. In an agentic context, this increases the risk of accidental or socially engineered destructive operations against a user's Google account and data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill requests broad Google OAuth scopes, including full calendar and drive access plus Gmail modify/send permissions, and states that tokens are persisted locally in a JSON file without any privacy warning or storage hardening details. If an agent, local process, or attacker gains access to the token file, they may obtain durable access to sensitive email, files, and calendar data with the ability to read, modify, and delete content.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The comment at L014 says the scopes are for Gmail, Calendar, and Drive, but the listed Gmail scopes and later handlers implement write-capable behavior including send, modify, and delete. This is not just incomplete documentation: the nearby comments and grouping suggest a neutral API-access description while the code performs destructive and message-sending actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill persists OAuth tokens to a local file without any disclosure, consent flow notice, or apparent permission hardening. Stored tokens can grant long-lived access to Gmail, Calendar, and Drive, so local compromise, accidental inclusion in backups, or workspace sharing could expose highly sensitive account access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function reads a local file path and uploads the file to Google Drive, transmitting user data over the network. There is no prompt, warning, or visible disclosure that local file contents will be sent to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The download function writes remote content to an arbitrary caller-supplied destination path with no validation or confinement. In an agent or automation environment, this can enable overwriting arbitrary files accessible to the process, causing data loss, persistence, or configuration tampering depending on where the file is written.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency uses a lower-bound specifier only, which allows installation of any newer version, including versions with breaking changes or newly introduced malicious/transitive supply-chain issues. While this is common practice and not inherently malicious, it reduces build reproducibility and weakens control over what code is installed.
- Content
text google-api-python-client>=2.0.0 google-auth-httplib2>=0.1.0 google-auth-oauthlib>=0.4.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
This dependency is not pinned to an exact version, so future installs may resolve to different releases over time. That increases exposure to supply-chain risk and makes environments less reproducible, even if the package itself is legitimate and widely used.
- Content
text google-api-python-client>=2.0.0 google-auth-httplib2>=0.1.0 google-auth-oauthlib>=0.4.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Using only a minimum version permits any later release to be installed, which can unexpectedly pull in vulnerable, incompatible, or compromised versions and their transitive dependencies. In a security-sensitive environment, that weakens change control over third-party code.
- Content
text google-api-python-client>=2.0.0 google-auth-httplib2>=0.1.0 google-auth-oauthlib>=0.4.0
Static analysis
No suspicious patterns detected.