FileChat RAG

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.0.1

Overview

This document-chat skill is useful, but it needs review because it can recursively process Google Drive files, send their contents to Gemini or OpenAI, and keep extracted text locally.

Install only if you are comfortable giving the agent access to the selected Google Drive folder and allowing document text, image contents, and search queries to be sent to Gemini or OpenAI. Prefer a dedicated Drive folder and dedicated API keys, avoid regulated or highly sensitive files unless your policy allows third-party AI processing, and delete the generated vector_db files when you no longer need the local index.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly uses environment variables for API keys and performs networked operations against Google Drive and external embedding providers, yet no permissions are declared. That under-specification weakens review and user consent because the skill can access secrets and transmit document contents externally without an explicit capability declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is described as 'securely stored' document search and retrieval, but the behavior includes sending document text and possibly image/OCR data to external AI services, plus capabilities that are not fully implemented as advertised. This mismatch can cause users to disclose sensitive files under false assumptions about storage, processing, and data flow, especially for medical or personal documents.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code performs OCR on image files by sending full image contents to Gemini, which expands the skill's effective data-processing scope beyond simple storage/retrieval and standard document indexing. In a file-chat/RAG skill, this means sensitive image contents may be extracted and transmitted to a third-party model without clear disclosure or explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script shells out via execSync to construct and run CLI commands using untrusted Drive-derived values such as folderId and fileId. Even though some quoting is attempted, using shell command construction for API access increases the risk of command injection, argument parsing issues, and unsafe handling of attacker-controlled metadata compared with using a native Google Drive client library.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README tells the agent to act when the user says generic phrases like 'sync' and broadly frames use cases around saving, retrieving, and chatting with files from any Google Drive folder. This creates an underspecified trigger surface where the skill may activate in contexts the user did not clearly intend, increasing the chance of unintended document indexing or retrieval of sensitive data.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The invocation conditions are broad enough that normal conversation about saving files, retrieving documents, or syncing folders could trigger the skill unexpectedly. In this context, unintended invocation is risky because the skill can access Google Drive, process sensitive documents, and potentially send their contents to external embedding providers.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill instructs creation of a .env file containing API keys but provides no warning about secret handling, storage lifetime, file permissions, or accidental exposure. This increases the chance of credential leakage through the workspace, logs, shell history, or later file access by other processes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs downloading files from Google Drive into the local workspace and sending them onward without disclosing that sensitive files will be stored locally, even if only temporarily. For a document-handling skill, this materially increases exposure risk because local copies can persist, be accessed by other tools, or remain after the task completes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs uploading user files to Google Drive and then syncing them for indexing, but it does not clearly disclose that the file will be transmitted to Google and may then be processed by external AI providers for embeddings/OCR. Because the skill is meant for personal document storage and Q&A, users may reasonably provide highly sensitive files without understanding the full external data flow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function sends raw image data to an external generative AI API without any visible disclosure, consent check, or sensitivity filtering. In a Google Drive RAG context, uploaded files may contain personal, financial, medical, or proprietary data, so silent transfer to a third party materially increases data exposure and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends the user's raw query text to third-party embedding providers (OpenAI or Google Gemini) to generate embeddings. In a document search skill, queries may contain sensitive business, personal, or regulated data, so transmitting them externally without explicit disclosure, consent, or provider controls creates a real privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Document chunks are sent to OpenAI or Google Gemini for embeddings, and image contents may also be sent for OCR, which constitutes external transmission of potentially sensitive user documents. In the context of a Google Drive indexing skill, this is especially risky because users may assume their files remain within Drive or the local vectorization environment, while the code forwards raw content to third-party AI providers.

External Transmission

Medium

• Category: Data Exfiltration

Content

async function getEmbedding(text) {
  if (EMBEDDING_PROVIDER === "openai") {
    const response = await fetch("https://api.openai.com/v1/embeddings", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",

• Confidence: 88% confidence
• Finding: fetch("https://api.openai.com/v1/embeddings", { method: "POST"

External Transmission

Medium

• Category: Data Exfiltration

Content

async function getEmbedding(text) {
  if (EMBEDDING_PROVIDER === "openai") {
    const response = await fetch("https://api.openai.com/v1/embeddings", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",

• Confidence: 88% confidence
• Finding: https://api.openai.com/

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: sync.js:33

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: query.js:15

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: sync.js:16