Google Power Tools

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:51 AM UTC
• Version: 2.1.9

Overview

This skill is a coherent Google Workspace helper, but it asks for very broad account access and documents live send, edit, and delete actions without enough scoping or confirmation guidance.

Review this before installing if you use Google Workspace for sensitive personal or business data. Prefer service-specific OAuth scopes, avoid full authorization unless you truly need comprehensive Workspace management, verify every recipient/file/calendar/sheet ID before mutating actions, and be cautious with file-backed credentials and global npm installation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:8

Finding

Unpinned Global Installation of a Security-Sensitive npm Dependency

Content

View full analysis

Remediation

View remediation

``` 2. Prefer a project-local installation with a committed lockfile over global installation: ```bash npm install --save-exact @googleworkspace/cli@ ``` 3. Verify registry provenance, package signatures or attestations where available, and expected package integrity before installation. 4. Review transitive dependencies and npm lifecycle scripts for each upgrade. 5. Disable lifecycle scripts during installation when compatible with the package: ```bash npm install --ignore-scripts --save-exact @googleworkspace/cli@ ``` 6. Run the CLI as an unprivileged user and avoid `sudo npm install -g`. 7. Document an explicit upgrade-review process rather than silently resolving the latest release each time. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:38

Finding

Full Google Workspace OAuth Authorization Is Recommended for Narrow Tasks

Content

View full analysis

export GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file gws auth login # first-time auth gws auth login --full # re-auth with all scopes if 403 error ``` Troubleshooting guidance in `SKILL.md:310-316`: ```markdown | Issue | Solution | |-------|----------| | 403 Insufficient scopes | `gws auth login --full` | | No OAuth client | Check `~/.config/gws/client_secret.json` | | API not enabled | Enable in GCP Console → APIs & Services | | jq parse error | Add `tail -n +2` to skip keyring prefix | | Upload shows "Untitled" | Rename with `files update` after upload | | File not found on upload | Use relative paths, `cd` first | ``` Authorization alternatives in `references/setup.md:72-84`: ```bash export GOOGLE_WORKSPACE_PROJECT_ID=your-project-id export GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file # Full authorization (all services) gws auth login --full # Or authorize only specific services gws auth login -s gmail,drive,calendar ``` The instructions then state that authorization credentials are stored at: ```text ~/.config/gws/credentials.enc ``` Scope-error recovery in `references/setup.md:111-115`: ```bash rm ~/.config/gws/token_cache.json gws auth login --full ``` Complete reauthorization in `references/setup.md:127-131`: ```bash rm ~/.config/gws/credentials.enc rm ~/.config/gws/token_cache.json gws auth login --full ``` ### Technical Analysis The Skill can be activated for a narrow operation, such as listing one calendar event, reading one email, or updating one spreadsheet. Nevertheless, its primary setup and generic authorizat ...[truncated 2654 chars]

Remediation

View remediation

``` 8. Document token revocation procedures through the Google Account security interface, not only local cache deletion. 9. Document the file-keyring threat model, encryption-key location, and required restrictive permissions for `~/.config/gws`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill’s invocation guidance is excessively broad, matching very common terms like 'email', 'presentation', and effectively any Google Workspace-related request. This can cause unintended activation in unrelated contexts and may route user requests into a high-privilege tool capable of reading, sending, deleting, or modifying cloud data, increasing the chance of accidental external side effects.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

{
            "bins": ["gws", "jq", "base64", "python3"],
            "env": ["GOOGLE_WORKSPACE_PROJECT_ID", "GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND"],
            "config": ["~/.config/gws/client_secret.json"]
          },
        "install":
          [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

md

{
            "bins": ["gws", "jq", "base64", "python3"],
            "env": ["GOOGLE_WORKSPACE_PROJECT_ID", "GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND"],
            "config": ["~/.config/gws/client_secret.json"]
          },
        "install":
          [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 65)May include surrounding context.

md

{
            "bins": ["gws", "jq", "base64", "python3"],
            "env": ["GOOGLE_WORKSPACE_PROJECT_ID", "GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND"],
            "config": ["~/.config/gws/client_secret.json"]
          },
        "install":
          [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 120)May include surrounding context.

md

{
            "bins": ["gws", "jq", "base64", "python3"],
            "env": ["GOOGLE_WORKSPACE_PROJECT_ID", "GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND"],
            "config": ["~/.config/gws/client_secret.json"]
          },
        "install":
          [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash

export GOOGLE_WORKSPACE_PROJECT_ID=<your-project-id>
export GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file
gws auth login          # first-time auth
gws auth login --full   # re-auth with all scopes if 403 error

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The guide explicitly sets GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file, indicating credentials will be stored in files instead of a system keychain/secure secret store. In a skill handling broad Google Workspace access, file-based token storage materially increases the risk of token theft from disk, backups, or other local compromise.

Content

Scanner excerpt · references/setup.md (reported line 75)May include surrounding context.

bash

export GOOGLE_WORKSPACE_PROJECT_ID=your-project-id
export GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file

# 完整授权（所有服务）
gws auth login --full

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup.md (reported line 114)May include surrounding context.

"Insufficient authentication scopes" (403)

bash

rm ~/.config/gws/token_cache.json
gws auth login --full

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup.md (reported line 130)May include surrounding context.

"Insufficient authentication scopes" (403)

bash

rm ~/.config/gws/token_cache.json
gws auth login --full

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup.md (reported line 129)May include surrounding context.

完全重新授权

bash

rm ~/.config/gws/credentials.enc
rm ~/.config/gws/token_cache.json
gws auth login --full

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup.md (reported line 144)May include surrounding context.

md

- 建议使用专用的 GCP 项目，并定期审查已授权的应用
   - 考虑使用 Service Account 或 Domain-wide Delegation 作为更安全的替代方案
3. 确认后点击 **"PUBLISH APP"**
4. 删除旧 token：`rm ~/.config/gws/token_cache.json`
5. 重新授权：`gws auth login --full`

**注意**：切换到 Production 后**必须重新授权**一次，之前的 token 仍然是 7天过期的。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Persisting the recommendation to export a file-based keyring backend in shell startup files normalizes long-term insecure storage for high-value OAuth tokens. That increases the blast radius by making insecure credential handling persistent across sessions and commands.

Content

Scanner excerpt · references/setup.md (reported line 164)May include surrounding context.

bash

export GOOGLE_WORKSPACE_PROJECT_ID=your-gcp-project-id
export GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: gws
description: "Google Workspace CLI. Make sure to use this skill whenever the user mentions Gmail, email, inbox, send email, read email, check mail, draft email, send invite; Google Drive, upload file, download file, cloud storage, share file; Google Docs, create a document, write a doc; Google Calendar, schedule meeting, check schedule, view events, agenda, share calendar; Google Sheets, spreadsheet; Google Slides, make a slide, presentation; Google Forms, survey, create a form; Google Tasks, to-do, reminder; Google Meet, meeting recording; Contacts, People, address book, contact list; Classroom — or any Google Workspace / G Suite operation, even if they don't say 'gws'. If authorization fails or scope is missing, guide the user through the complete OAuth setup process."
license: MIT
homepage: https://github.com/googleworkspace/cli
metadata:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents many commands that create, modify, send, share, delete, or otherwise change Google Workspace resources, but it does not embed clear operational guardrails about user consent and side effects. In an agent setting, this raises the risk of sending emails, changing calendar events, editing documents, or altering Drive contents without sufficiently explicit confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The reference documentation includes destructive commands such as gws calendar events delete and gws calendar calendars delete with no surrounding warning, confirmation guidance, or safe-usage context. In an agent skill focused on Google Workspace operations, this increases the chance that an agent or user may invoke deletion commands directly against real calendar data, causing unintended loss of events or entire calendars.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The reference includes a destructive delete command with no warning, confirmation pattern, or recovery guidance. In the context of a Google Workspace skill, where agents may act on user files at scale, this makes accidental or coerced deletion materially more dangerous and can lead to irreversible data loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation normalizes an unexpected saved_file value on a delete operation and tells operators to ignore it, which can mask incorrect or misleading tool behavior. In a Google Drive skill handling sensitive user data, this increases the chance that users overlook unintended filesystem writes, failed deletes, or tampered command behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples for reply, reply-all, forward, and send demonstrate outbound email actions without warnings about privacy, recipient verification, or the fact that these actions send data externally. In a Google Workspace agent skill, this is more dangerous because the skill is explicitly meant to be used for live Gmail operations, so examples may normalize sending or forwarding sensitive content without adequate user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This reference includes state-changing Gmail operations such as batchModify and modify that can mark messages read, star them, or remove them from the inbox without any warning about irreversible or user-visible effects. In an agent skill context, cookbook-style examples can be operationalized directly by an LLM or user, increasing the risk of unintended mailbox modification at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Attachment download and trash/untrash examples are presented as straightforward commands without cautionary guidance about sensitive-file handling, destination safety, or mailbox state changes. Within this skill's context, attachment retrieval can expose confidential data to local storage and trash operations can alter retention and user workflow, making these examples riskier than generic documentation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

This duplicate finding points to the same behavior: establishing a desktop OAuth flow that results in persistent local credentials for sensitive Workspace access. Combined with broad scopes and production-mode guidance, it increases the risk of unauthorized long-term account access if those credentials are exposed.

Content

Scanner excerpt · references/setup.md (reported line 63)May include surrounding context.

md

### 2.3 OAuth 凭证

1. 访问 `apis/credentials` → "+ CREATE CREDENTIALS" → "OAuth client ID"
2. 应用类型：**Desktop app**
3. 下载 JSON → 保存为 `~/.config/gws/client_secret.json`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

This duplicate finding points to the same behavior: establishing a desktop OAuth flow that results in persistent local credentials for sensitive Workspace access. Combined with broad scopes and production-mode guidance, it increases the risk of unauthorized long-term account access if those credentials are exposed.

Content

Scanner excerpt · references/setup.md (reported line 63)May include surrounding context.

md

### 2.3 OAuth 凭证

1. 访问 `apis/credentials` → "+ CREATE CREDENTIALS" → "OAuth client ID"
2. 应用类型:**Desktop app**
3. 下载 JSON → 保存为 `~/.config/gws/client_secret.json`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown reference includes commands to clear cell ranges and delete rows, both of which can remove user data, but it does not provide any warning about data loss or advise verifying the target spreadsheet/range first. Under the markdown-file criteria, examples that affect user data should disclose potentially destructive behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The reference includes destructive task operations (delete and clear) with no caution, confirmation guidance, or indication that the actions are irreversible. In a skill intended to be used whenever users mention Google Workspace actions, these examples can normalize unsafe copy-paste use and increase the chance of accidental data loss in a real account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file provides commands that create and modify Google Docs, Slides, and Forms content, including inserting text, images, slides, and form questions. The examples are operational and data-affecting, but the document does not include any warning or note that these commands will change remote user data.

Content

No source excerpt is available for this finding.