Google Sheets API

• Analyzed: May 12, 2026, 3:17 AM
• Findings: 1
• Version: 1.0.3
• Hash: 56cf0c53f0e9de8b370c829d91ab815ef6556f0a46c6f97495fd3bc464ae9b4a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its implementation of credential discovery, which involves reading sensitive files from various locations, including `~/.config/google-sheets/credentials.json` (as seen in `scripts/sheets-cli.js`). While this file access is plausibly needed for the skill's stated purpose of authenticating to the Google Sheets API, it represents a high-risk capability. There is no clear evidence of intentional malicious behavior such as exfiltration of these credentials to unauthorized endpoints or other unrelated sensitive data, nor are there any prompt injection attempts in `SKILL.md` to mislead the agent into harmful actions. However, the broad file access for credentials, even if for a legitimate purpose, elevates it beyond benign.