Tmp.7SpQQuUu6P

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:15 AM UTC
• Version: 2.8.0

Overview

This Google Docs skill has a coherent purpose, but it needs review because it can change or remove documents and installs an unpinned npm package automatically.

Install only if you trust the MCP package source and are comfortable granting it access to the configured Google account. Prefer pinning the npm package version, using a dedicated low-privilege Google account, checking Docs version history or backups before large edits, and requiring explicit confirmation before delete, trash, replace, or comment-deletion operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–27
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "gogcli-docs": {
      "command": "npx",
      "args": ["-y", "gogcli-mcp-docs"],
      "env": {
        "GOG_ACCOUNT": "[e-mail]"
      }
    }
  }
}

Technical Analysis

The configuration invokes npx -y gogcli-mcp-docs without pinning the npm package to an exact, reviewed version or verifying its integrity. The -y option suppresses the installation confirmation, allowing npm to automatically retrieve and execute the package version resolved at runtime.

Consequently, the executable package can change after the Skill has been audited. The referenced GitHub repository does not cryptographically bind the npm artifact executed by npx to a specific reviewed source revision. This creates a supply-chain exposure if the package, a maintainer account, the publication workflow, or a transitive dependency is compromised.

Attack Path

1. An attacker compromises the gogcli-mcp-docs npm package, its maintainer account, publication pipeline, or a dependency included in a new release.
2. The attacker publishes or causes npm to resolve a malicious package version.
3. A user starts the configured MCP server.
4. npx -y retrieves the currently resolved package without requesting installation confirmation.
5. The malicious package executes with the operating-system privileges and environment available to the MCP process.
6. The payload may access local files, process-accessible credentials, authentication material, and Google Docs data available through the authenticated account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the Agent or MCP server. The compromise scope may include readable or writable local resources, env ...[truncated 504 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact reviewed version, such as gogcli-mcp-docs@X.Y.Z, rather than resolving the latest compatible release at runtime.
• Install dependencies through a committed lockfile and enforce npm integrity hashes with npm ci.
• Avoid automatic runtime package retrieval where possible. Install the reviewed artifact during a controlled deployment phase and execute the installed binary directly.
• Verify that the npm package provenance corresponds to the intended source repository and reviewed commit. Use registry provenance/signature verification where supported.
• Review and pin transitive dependencies, and enable automated vulnerability and unexpected-release monitoring.
• Run the MCP server in a sandbox or restricted service account with minimal filesystem, network, environment-variable, and Google account permissions.
• Keep authentication material out of broadly accessible process environments and rotate credentials if package compromise is suspected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The tool list includes clearly destructive capabilities such as gog_docs_delete and gog_docs_trash, yet the documentation provides no explicit warning that content or entire documents may be removed. Because this skill is meant to be selected and used by an agent, omission of deletion warnings materially raises the risk of accidental data loss from overbroad or mistaken tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly advertises write, edit, export, comment, and document-management actions but does not warn that some operations can irreversibly modify or remove user content. In an agent setting, missing safety cues increases the chance that destructive actions are invoked without clear user confirmation or operator awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.