Security audit
Security checks across malware telemetry and agentic risk
This Google Drive document-search skill mostly matches its purpose, but it needs review because it handles private Drive content, credentials, and third-party AI services with some under-disclosed and unsafe patterns.
Install only if you are comfortable granting Drive access and having selected document contents, image data, and search queries processed by Gemini or OpenAI and possibly stored in local JSON files or Qdrant. Avoid syncing highly sensitive folders until the publisher fixes the native-OCR misstatement, removes embedded credentials, validates folder IDs, and adds clear opt-in, retention, and deletion controls.
async function getEmbedding(text) {
if (EMBEDDING_PROVIDER === "openai") {
const response = await fetch("https://api.openai.com/v1/embeddings", {
method: "POST",
headers: {
"Content-Type": "application/json",async function getEmbedding(text) {
if (EMBEDDING_PROVIDER === "openai") {
const response = await fetch("https://api.openai.com/v1/embeddings", {
method: "POST",
headers: {
"Content-Type": "application/json",*Note: Syncs are highly incremental and use a local cache! If a file hasn't been modified in Drive, the script will skip it instantly and output "0 chunks" embedded. This is NORMAL behavior. If you are debugging, testing, or the user specifically requests a hard flush, you MUST delete the cache files first:* ```bash rm ./skills/filechat/meta_<FOLDER_ID>.json rm ./skills/filechat/vector_db_<FOLDER_ID>.json ```
*Note: Syncs are highly incremental and use a local cache! If a file hasn't been modified in Drive, the script will skip it instantly and output "0 chunks" embedded. This is NORMAL behavior. If you are debugging, testing, or the user specifically requests a hard flush, you MUST delete the cache files first:* ```bash rm ./skills/filechat/meta_<FOLDER_ID>.json rm ./skills/filechat/vector_db_<FOLDER_ID>.json ``` ## How to Answer User Questions (RAG)
*(If this fails, check folder permissions or GWS credentials.)* 3. **Force a Clean Sync:** Clear the cache for the test folder to guarantee a fresh run, then sync. ```bash rm -f ./skills/filechat/meta_<FOLDER_ID>.json ./skills/filechat/vector_db_<FOLDER_ID>.json node ./skills/filechat/sync.js <FOLDER_ID> ``` *(You should see files being downloaded, OCR'd, and chunks being embedded. If it says "0 chunks", verify the folder isn't empty.)*
64/64 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal