Tmp.MII9JI7trn

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 2.8.0

Overview

This Google Sheets skill is purpose-aligned, but it runs an unpinned npm MCP server with an authenticated account and exposes live write, delete, copy, and export actions.

Review before installing. Use a dedicated Google account or limited-access workspace, pin or locally verify the MCP package before use, and require explicit confirmation plus a backup before delete, overwrite, export, copy, merge, or structural edits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–23
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json

"command": "npx",
"args": ["-y", "gogcli-mcp-sheets"],

Technical Analysis

The documented MCP configuration invokes npx with the -y option and an unversioned npm package name. When the package is not already available in the relevant cache, npx can retrieve the currently published version and execute it without interactive confirmation.

Because no exact version, lockfile, integrity hash, or verified artifact is specified, the code executed at startup may differ from the package version that was originally reviewed. A compromised maintainer account, malicious package release, registry compromise, or unexpected upstream change could introduce arbitrary code into the MCP server execution path.

The resulting process runs with the operating-system privileges of the user launching the MCP client. It may also inherit the configured GOG_ACCOUNT value and operate in an environment where Google authentication material is available to the gogcli integration.

Attack Path

1. An attacker compromises the npm package, its publisher account, or another part of its publication pipeline.
2. The attacker publishes a malicious release under the existing gogcli-mcp-sheets package name.
3. A user starts the MCP configuration shown in SKILL.md.
4. npx -y resolves and downloads the unpinned current package without requesting confirmation.
5. The malicious package executes with the invoking user's local privileges.
6. The payload attempts to access local files, environment data, authentication material, or Google Sheets resources available through the authenticated integration.

This path depends on compromise or malicious modification of the external package or its distribution channel; the audited file does not itself contain a malicious payload.

Impact Assessment

...[truncated 503 chars]

Remediation

View remediation

Remediation Suggestions

• Pin gogcli-mcp-sheets to an exact, reviewed version rather than allowing automatic resolution of the latest release.
• Install dependencies through a committed lockfile that records integrity hashes, and use a reproducible installation workflow such as npm ci.
• Avoid npx -y for security-sensitive server startup because it suppresses confirmation before package retrieval and execution.
• Prefer a preinstalled, verified local executable or a package artifact obtained from a trusted and controlled source.
• Verify package provenance, publisher identity, signatures or attestations where available, and registry integrity before deployment.
• Review dependency updates before adoption and use automated supply-chain monitoring.
• Run the MCP server in a sandbox or isolated account with restricted filesystem, network, and process permissions.
• Grant the Google account and OAuth integration only the minimum spreadsheet scopes and document access required for the intended task.
• Separate sensitive spreadsheets from the account used by the integration and periodically revoke or rotate authentication material.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to activate on many ordinary spreadsheet-related requests, increasing the chance this skill is selected when a narrower or safer capability would suffice. Over-broad routing can expose users to unnecessary write-capable tooling and raise the risk of unintended data access or modification in Google Sheets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation advertises numerous destructive or modifying operations such as delete, rename, merge, insert, update, and export without any caution about confirmation, backups, or user-impact. In a skill that can act on live spreadsheets, this makes accidental or unauthorized data loss, corruption, or exfiltration more likely, especially because auth and write tools are bundled together.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.