Security audit

Filechat

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Google Drive RAG purpose, but it handles sensitive documents and credentials with several serious implementation and disclosure risks.

Review this skill carefully before installing. It can recursively read Google Drive folders, extract text including OCR, send content to embedding providers and optionally Qdrant, persist raw document chunks locally, and upload/download files. Do not use it with sensitive folders until folder ID validation, credential removal/rotation, safer subprocess calls, pinned tooling, explicit deletion confirmation, and clearer data-retention controls are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: sync.js:52
Finding: Shell Command Injection Through Unvalidated Google Drive Folder IDs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tests/credentials.json:2
Finding: Google OAuth Client Secret and Gemini API Key Committed to Source
Content: View full analysis
", "redirect_uris": ["http://localhost"] } } ``` `tests/setup.js:8-16` reads and propagates that secret and also contains a literal Gemini API key: ```js const credentialsStr = fs.readFileSync(credentialsPath, 'utf8'); const credentials = JSON.parse(credentialsStr); const env = { ...process.env, GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: credentialsPath, GOOGLE_WORKSPACE_CLI_CLIENT_ID: credentials.installed.client_id, GOOGLE_WORKSPACE_CLI_CLIENT_SECRET: credentials.installed.client_secret, GEMINI_API_KEY: '' }; ``` The same Gemini key is repeated in `tests/skill.test.js`: ```js const env = { ...process.env, GEMINI_API_KEY: '' }; ``` The literal values are intentionally redacted from this report to avoid further credential disclosure. ### Technical Analysis Secrets stored in tracked project files become available to every person and system that receives the source package or repository history. Moving a committed secret to an environment variable at runtime does not protect it when the original value remains in source. The test setup passes the exposed credentials to subprocesses. Although the reviewe ...[truncated 1633 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: sync.js:207
Finding: Sensitive Drive Document Content Stored in Plaintext and Sent to Unvalidated Qdrant Endpoints
Content: View full analysis
0) { await qdrant.upsert(collectionName, { wait: true, points }); } ``` The local database is written without explicit restrictive permissions or encryption: ```js if (!USE_QDRANT) { fs.writeFileSync(DB_PATH, JSON.stringify(db)); console.log(`Sync complete. Local database saved to disk with ${db.length} total chunks.`); } else { console.log(`Sync complete. Updated Qdrant database.`); } ``` Queries also trust the configured endpoint: ```js const qdrant = new QdrantClient({ url: QDRANT_URL, apiKey: QDRANT_API_KEY }); const collectionName = `filechat_${ROOT_FOLDER_ID}`; const searchResult = await qdrant.search(collectionName, { vector: queryEmbedding, limit: 3, with_payload: true }); ``` ### Technical Analysis The local vector database is not merely a set of embeddings. It contains raw extracted text, Google Drive file identifiers, filenames, and chunk indexes. These values can include medical, financial, legal, or other confidential informatio ...[truncated 2532 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (67)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill actually executes arbitrary subprocesses, exports API keys, and deletes local files while presenting itself as a benign RAG utility, the mismatch materially increases operational risk. In security-sensitive agent ecosystems, inaccurate declarations can bypass scrutiny and lead to over-privileged deployment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill actually executes arbitrary subprocesses, exports API keys, and deletes local files while presenting itself as a benign RAG utility, the mismatch materially increases operational risk. In security-sensitive agent ecosystems, inaccurate declarations can bypass scrutiny and lead to over-privileged deployment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill actually executes arbitrary subprocesses, exports API keys, and deletes local files while presenting itself as a benign RAG utility, the mismatch materially increases operational risk. In security-sensitive agent ecosystems, inaccurate declarations can bypass scrutiny and lead to over-privileged deployment.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The skill instructs creation and use of a plaintext .env file for embedding provider configuration and API keys. Storing secrets in a workspace path used by an agent skill increases the likelihood of accidental disclosure through logs, file reads, packaging, or other tool access.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
Create the .env file like this:

bash
echo "EMBEDDING_PROVIDER=gemini" > ./skills/filechat/.env echo "GEMINI_API_KEY=your_key_here" >> ./skills/filechat/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: This line directly demonstrates writing a sensitive API key into a local .env file. In the context of a document-processing skill with shell access, that secret may be exposed to other commands, subprocesses, or accidental file exfiltration.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
Create the .env file like this:

bash
echo "EMBEDDING_PROVIDER=gemini" > ./skills/filechat/.env echo "GEMINI_API_KEY=your_key_here" >> ./skills/filechat/.env

Google Workspace Authentication:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The command deletes a path derived from <FOLDER_ID> without any visible sanitization or path restriction checks. If the folder identifier is attacker-controlled or malformed, this pattern can enable unintended file deletion or shell/path manipulation when used by an agent or copied into scripts.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
Note: Syncs are highly incremental and use a local cache! If a file hasn't been modified in Drive, the script will skip it instantly and output "0 chunks" embedded. This is NORMAL behavior. If you are debugging, testing, or the user specifically requests a hard flush, you MUST delete the cache files first:

bash
rm ./skills/filechat/meta_<FOLDER_ID>.json rm ./skills/filechat/vector_db_<FOLDER_ID>.json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: This deletion command has the same unsafe parameterization issue for the vector database file. In a skill that handles persistent state and potentially sensitive document embeddings, unintended deletion can cause loss of data availability and integrity.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
Note: Syncs are highly incremental and use a local cache! If a file hasn't been modified in Drive, the script will skip it instantly and output "0 chunks" embedded. This is NORMAL behavior. If you are debugging, testing, or the user specifically requests a hard flush, you MUST delete the cache files first:

bash
rm ./skills/filechat/meta_<FOLDER_ID>.json rm ./skills/filechat/vector_db_<FOLDER_ID>.json

How to Answer User Questions (RAG)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: Combining multiple rm -f targets with an interpolated <FOLDER_ID> inside a validation workflow amplifies the risk of destructive misuse. Because it is presented as a routine test step, an operator or agent may execute it with untrusted or mistaken input, causing broader file deletion than intended.
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
(If this fails, check folder permissions or GWS credentials.) 3. Force a Clean Sync: Clear the cache for the test folder to guarantee a fresh run, then sync.

bash
rm -f ./skills/filechat/meta_<FOLDER_ID>.json ./skills/filechat/vector_db_<FOLDER_ID>.json node ./skills/filechat/sync.js <FOLDER_ID>

(You should see files being downloaded, OCR'd, and chunks being embedded. If it says "0 chunks", verify the folder isn't empty.)

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.2 — 5 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection) +2 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==10.2.0 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.3 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · query.js (reported line 4)May include surrounding context.
js
const fs = require('fs'); const path = require('path'); const { QdrantClient } = require('@qdrant/js-client-rest'); require('dotenv').config({ path: path.join(__dirname, '.env') }); const folderArg = process.argv[2]; const query = process.argv[3];

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · sync.js (reported line 6)May include surrounding context.
js
const fs = require('fs'); const path = require('path'); const { QdrantClient } = require('@qdrant/js-client-rest'); require('dotenv').config({ path: path.join(__dirname, '.env') }); const folderArg = process.argv[2]; const query = process.argv[3];

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tests/setup.js (reported line 6)May include surrounding context.
js
const fs = require('fs'); describe('FileChat RAG Skill', () => { const credentialsPath = path.join(__dirname, 'credentials.json'); beforeAll(() => { // Ensure we have the credentials to authenticate GWS CLI

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tests/skill.test.js (reported line 6)May include surrounding context.
js
const fs = require('fs'); describe('FileChat RAG Skill', () => { const credentialsPath = path.join(__dirname, 'credentials.json'); beforeAll(() => { // Ensure we have the credentials to authenticate GWS CLI

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Injecting a hardcoded API key into the environment without any safeguards is a true credential exposure issue, not merely a documentation problem. The key is plainly recoverable from source and can be reused by anyone with repository access, making the skill more dangerous because it touches external services and may run in shared CI or developer environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises recursive Google Drive syncing, OCR of images, embedding, and persistent local vector storage, but it does not warn users that potentially sensitive document contents will be copied, transformed, and retained locally. In this context, the omission is security-relevant because users may unknowingly index private files, including data reachable through subfolders and shortcuts, creating confidentiality and retention risks.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool scope or allowed-tools despite requiring environment access, package installation, network access, and Google Drive operations. This increases the chance of overbroad execution and makes it harder to constrain what the agent may do when handling sensitive documents and credentials.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions are broad enough that the skill may activate on generic user requests about files, saving, retrieval, or syncing. In a skill with Drive access, upload/download behavior, and indexing, accidental invocation could cause unintended document access, storage, or modification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using npx @googleworkspace/cli without pinning a specific version causes runtime retrieval of whatever package version is current, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the agent environment with access to local files, OAuth tokens, and document data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This invocation again relies on an unpinned npx package fetch for authentication flow. Because it is used during login, compromise here would be especially sensitive: the executed code could intercept tokens or manipulate OAuth behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions tell the agent to delete cache/index files as part of debugging or hard flush without requiring user confirmation or emphasizing data-loss consequences. In practice, this can destroy local indexing state and backups, causing availability loss and potentially forcing reprocessing of sensitive documents.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Credential Access

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

How to Answer User Questions (RAG)

Tool Parameter Abuse

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

Credential Access

Credential Access

Credential Access

Credential Access

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Vague Triggers

Rp1

Rp1

Missing User Warnings