T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:29
- Finding
- Hard-Coded Recipient Receives Spreadsheet Access Without User Confirmation## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: Persistent disclosure of spreadsheet data to a hard-coded recipient **Risk Level**: Medium ```text 4. Share with manager: `gws drive permissions create --params '{"fileId": "SHEET_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "manager@company.com"}'` ``` ### Technical Analysis The recipe directs the agent to create a persistent Google Drive permission for the fixed address `manager@company.com`. It does not obtain the intended recipient from the user, validate that the address belongs to the user's organization, or request confirmation immediately before sharing. This behavior is not disclosed in the Skill's summary, which only states that it sets up a spreadsheet with headers and initial entries. Consequently, an agent executing the recipe verbatim may disclose the spreadsheet to an unintended account. The permission applies to the file rather than only its initial contents, so the recipient could also read expense information added later. ### Attack Path 1. A user or agent invokes the Skill to create an expense tracker. 2. The recipe creates a Google Sheets file in the authenticated user's Drive. 3. It adds the expense headers and sample expense entry. 4. The agent executes the permission command without obtaining a recipient or explicit sharing confirmation from the user. 5. Google Drive grants `reader` access to `manager@company.com`. 6. That account can access the spreadsheet and subsequently view additional expense data entered into the same file. ### Impact Assessment The hard-coded recipient obtains persistent read access to the created spreadsheet. The access does not grant edit rights or broader control over the user's Google account, but it can expose the spreadsheet's current and future contents. Depending on actual usage, disclosed data may include financial transactions, travel details, descriptions, ...[truncated 196 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic sharing from the default expense-tracker creation workflow. 2. If sharing is requested, obtain the recipient address directly from the user rather than using a fixed value. 3. Display the exact file, recipient, and permission level, then require explicit confirmation immediately before creating the permission. 4. Validate the recipient address and, where applicable, restrict sharing to approved organizational domains. 5. Apply least privilege by using `reader` access only when that level is specifically requested. 6. Clearly disclose the sharing behavior in the Skill description and execution summary. 7. After execution, report the permission created and provide instructions for reviewing or revoking it.