T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/google_workspace.py:23- Finding
All Commands Request Excessive Cross-Service Google Workspace Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Google Workspace
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Google Workspace automation tool, but it requests and stores broad account access with limited guardrails, so it should receive manual review before installation.
Install only if you are comfortable granting broad Google Workspace access. Prefer a dedicated least-privilege account, avoid domain-wide delegation unless required, keep token files in a private directory, review any Drive public-sharing or calendar-deletion command before use, and revoke tokens if the machine or token file may be exposed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/google_workspace.py:47- Finding
OAuth Refresh Token Is Stored Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:91- Finding
Dependency Installation Instructions Use Unpinned Package Versions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Option 2: OAuth credentials file
bash export GOOGLE_CREDENTIALS_FILE="/path/to/credentials.json" export GOOGLE_TOKEN_FILE="/path/to/token.json" # created on first run
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises capabilities that can access environment variables, write files, and use the network, but it does not declare any explicit tool scope or permission boundaries. For a Google Workspace automation skill, this creates a meaningful trust and review gap because the skill can potentially access sensitive credentials and perform broad remote actions without clear user-facing restrictions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description presents powerful Gmail, Calendar, Drive, and Sheets actions as routine automation but omits warnings that the skill may read private mail, modify or delete calendar events, upload/download Drive content, share files publicly, and write spreadsheet data. This increases the risk of unsafe use because users may grant broad credentials without understanding the scope or destructive potential.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
When OAuth credentials are refreshed or obtained, the code persists the token to ~/.google_token.json or another configured path, but there is no user-facing disclosure that credential material will be stored on disk. Writing authentication tokens locally is a safety-relevant file write involving sensitive data and should be disclosed.
- Content
Tainted flow: 'token_file' from os.environ.get (line 52, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 89% confidence
- Finding
The OAuth token path is taken directly from the GOOGLE_TOKEN_FILE environment variable and then opened for writing without validation. In an agent/tooling context, an attacker who can influence environment configuration could cause credential material to be written to an unintended location, enabling overwrite of sensitive files or placement of tokens in world-readable or attacker-accessible paths.
- Content
python else: flow = InstalledAppFlow.from_client_secrets_file(creds_file, SCOPES) creds = flow.run_local_server(port=0) with open(token_file, "w") as f: f.write(creds.to_json()) return creds
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The cal_delete function performs a destructive remote operation by deleting a calendar event immediately, but there is no confirmation prompt, warning message, or explanatory comment/docstring disclosing that behavior. For a code file, destructive or irreversible operations should have some visible user disclosure unless clearly covered elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This command can create new Drive permissions, including public 'anyone' links, with no guardrails, confirmation, or policy checks. In an agent skill with broad Google Workspace scopes, this materially raises the risk of accidental or induced data exposure, especially if an upstream prompt or workflow can trigger sharing of sensitive files.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The drive_download function writes downloaded content to a local file via open(output, "wb"), but the code provides no warning, prompt, or explanatory comment that a filesystem write will occur. File writes are in scope for missing-warning checks when there is no visible disclosure.
- Content