Security audit

French Learning

Security checks for vulnerabilities and agentic risk

Overview

This French-learning automation is mostly coherent, but it can clear and overwrite a hard-coded Google Sheet and send spreadsheet text to Gemini, ElevenLabs, and Google Drive without a clear confirmation step.

Install only if you are comfortable with the configured Google Sheet content being sent to Gemini, generated French sentences being sent to ElevenLabs, the target Google Sheet range A1:F1000 being cleared and replaced, and MP3 files being uploaded to the configured Google Drive folder. Review or change the hard-coded Sheet and Drive IDs before running, and avoid using sensitive, personal, or proprietary spreadsheet content.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: # Use bash to pass the file content directly cmd_update = f"gog sheets update {TARGET_SHEET_ID} '{TARGET_SHEET_NAME}!A1' --values-json \"$(cat /tmp/french_learning_output_data.json)\" --json --input=USER_ENTERED" subprocess.run(cmd_update, shell=True)
Confidence: 96% confidence
Finding: The code executes a shell command with shell=True and embeds command substitution $(cat /tmp/french_learning_output_data.json). Even though the path and sheet identifiers are hardcoded, invoking a shell unnecessarily expands the attack surface: shell metacharacter handling, PATH hijacking of the gog binary, and unintended execution behavior can all turn a data update into arbitrary command execution or unsafe external side effects.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises and relies on script execution, file reading, and external tooling (`sag`, `gog`, `gemini`) but does not declare corresponding permissions. This creates a transparency and governance gap: an agent or reviewer may underestimate what the skill can access or execute, increasing the chance of unintended file access or shell-based actions during invocation.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Using shell execution to modify a Google Sheet is an unnecessary privileged mechanism for a simple data transfer task. This increases operational risk because the skill is granted command execution capability beyond what is needed, making compromise, misuse, or accidental abuse easier than if a direct API/library call were used.

Description-Behavior Mismatch

Medium

Confidence: 79% confidence
Finding: The implementation materially exceeds the declared skill purpose by reading from one sheet, generating new multilingual content with an LLM, and writing to another sheet. This capability mismatch reduces operator awareness and can cause unintended data disclosure to external services or unauthorized modification of remote documents.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The script sends vocabulary data to Gemini to generate Chinese translations and example sentences, which is outside the narrowly stated formatting/audio workflow. In a skill context, undisclosed model augmentation is risky because user-provided sheet contents are transmitted to a third-party model and the generated output is trusted for later persistence.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger phrases like 'generate audio' and 'French Excel file' are broad enough that the skill could be invoked in situations not clearly intended by the user. Overbroad activation increases the risk of accidental processing of documents and transmission of content to external services without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow description states that worksheet content is sent to Gemini for translation/example generation and to ElevenLabs for audio generation, but it does not prominently warn users that their spreadsheet content will leave the local environment and be transmitted to third-party services. This is a meaningful privacy and data-handling risk, especially if the worksheet contains sensitive notes, student data, or proprietary content.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script writes to a fixed external Google Sheet automatically, with no user confirmation, audit prompt, or visible notice in the code path. In an automation skill that handles user-provided French vocabulary data, silent export to an external spreadsheet can cause unintended disclosure, integrity issues, or surprise side effects if the file contents are manipulated or sensitive.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script clears the entire target range and then overwrites it without any confirmation, backup, or transactional safeguard. In this skill context that is dangerous because a mistaken invocation, malformed model output, or wrong target ID can irreversibly destroy user data in a cloud document.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script takes sentence text from a Google Sheet and sends it to ElevenLabs for audio generation, then uploads resulting files to Google Drive, but provides no consent check, disclosure, or data classification guardrail. If the sheet contains personal, proprietary, or otherwise sensitive content, this silently transfers that data to third-party services and expands exposure beyond the original sheet.

Static analysis

No suspicious patterns detected.