Andrew Google Tasks

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This Google Tasks skill is mostly purpose-aligned, but it stores and reloads its OAuth token with an unsafe Python pickle file that could run local code if tampered with.

Install only if you are comfortable granting full Google Tasks access and running local Python code. Before use, prefer replacing pickle token storage with Google's JSON credential serialization, keep credential and token files private, install dependencies in a virtual environment with pinned versions, and review any task deletion or update actions before invoking them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tasks_ops.py:29

Finding

Unsafe Deserialization of a Persistent OAuth Token

Content

View full analysis

Vulnerability Details

File Location: scripts/tasks_ops.py, lines 29-31
Vulnerability Type: Unsafe Python pickle deserialization
Risk Level: High

python

if TOKEN_FILE.exists():
    with open(TOKEN_FILE, 'rb') as token:
        creds = pickle.load(token)

Technical Analysis

The authentication routine deserializes ~/.google-tasks-token.pickle using pickle.load(). Python pickle data is executable serialization: specially constructed reduction instructions can invoke attacker-selected Python callables during deserialization. Consequently, pickle must not be used to load data whose integrity cannot be guaranteed.

The token is read from a predictable path in the user's home directory. The implementation does not verify that the file is a regular file, reject symbolic links, validate its owner or permissions, or cryptographically authenticate its contents. Merely reaching pickle.load() is sufficient to execute a malicious payload; the object does not need to represent valid Google credentials.

Attack Path

1. An attacker obtains the ability to create or modify ~/.google-tasks-token.pickle, such as through another compromised process running as the user, an insecure restoration process, or incorrectly configured home-directory permissions.
2. The attacker writes a crafted pickle whose deserialization method invokes an attacker-selected Python callable.
3. The user invokes the Skill's script or any function that calls get_tasks_service().
4. authenticate() detects the token file and passes it to pickle.load().
5. The payload executes before credential validity is checked.

This path requires prior write access to the token location or an equivalent filesystem manipulation capability; the repository does not itself provide that access.

Impact Assessment

Successful exploitation provides arbitrary code execution with the operating-system privileges of the user running the Skill. T ...[truncated 306 chars]

Remediation

View remediation

Remediation Suggestions

• Replace pickle persistence with a non-executable format. Serialize only the credential fields required by google.oauth2.credentials.Credentials, preferably using its supported JSON serialization facilities, and reconstruct credentials explicitly from validated fields.
• Create the token file with owner-only permissions, such as mode 0600, and ensure its parent directory is not writable by other users.
• Before reading, reject symbolic links and non-regular files and verify expected ownership and restrictive permissions.
• Write updates atomically through a securely created temporary file in the same protected directory, set restrictive permissions, and then replace the destination.
• Treat the existing pickle file as untrusted during migration. Do not deserialize it automatically; require reauthentication or use a separately reviewed one-time migration process.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:25

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-27
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Low

bash

pip install google-api-python-client google-auth-httplib2 google-auth-oauthlib

Technical Analysis

The setup instructions install third-party packages without exact version constraints or package hashes. Each installation therefore resolves mutable package versions and their transitive dependencies at installation time. This prevents reproducible dependency resolution and makes the installed code dependent on the current state of the configured Python package index.

The documented package names are consistent with the Skill's Google API functionality, and no typosquatted or unrelated package was identified. The risk arises from the absence of version locking, integrity verification, and an explicitly isolated environment rather than from a confirmed malicious dependency.

Attack Path

1. A user follows the documented pip install command.
2. Pip resolves the latest compatible releases from the user's configured index and resolves unconstrained transitive dependencies.
3. If a selected release or package source has been compromised, malicious package code is downloaded and installed.
4. Installation hooks or later imports can execute that code with the user's privileges.

Exploitation depends on an upstream package, release, configured index, or dependency-resolution channel being compromised; no such compromise was observed in the audited project.

Impact Assessment

A compromised dependency could execute code with the privileges of the installing or running user. Potential scope includes access to local user files, OAuth credentials, Google Tasks tokens, and any Google Tasks data authorized by the stored token. Installing globally or with elevated privileges would increase the impact, although the documentation does not instruct users to install with elevat ...[truncated 14 chars]

Remediation

View remediation

Remediation Suggestions

• Add a reviewed dependency lock file containing exact direct and transitive versions.
• Record and enforce cryptographic hashes, for example with pip install --require-hashes -r requirements.txt.
• Periodically update locked dependencies through a controlled review and vulnerability-scanning process.
• Instruct users to install dependencies inside a dedicated virtual environment rather than into the system Python environment.
• Use a trusted package index and explicitly review unexpected dependency-resolution changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tasks_ops.py (reported line 18)May include surrounding context.

python

SCOPES = ['https://www.googleapis.com/auth/tasks']

# 인증 파일 경로
CREDENTIALS_FILE = Path.home() / '.google-credentials.json'
TOKEN_FILE = Path.home() / '.google-tasks-token.pickle'

Ae2

Medium

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Artifact content does not match its filename extension

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s natural-language documentation is entirely in Korean, starting with the module docstring, with no indication that the skill is region-specific or that users may choose another language. This can violate language/locale policy when a skill imposes a language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Insecure deserialization: pickle.load()

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The code deserializes credentials from a pickle file in the user's home directory using pickle.load(), which can execute arbitrary Python code during loading. If an attacker can replace or tamper with ~/.google-tasks-token.pickle through local compromise, malicious sync, or another vulnerable component, running this skill could lead to arbitrary code execution under the user's account.

Content

Scanner excerpt · scripts/tasks_ops.py (reported line 31)May include surrounding context.

python

# 기존 토큰이 있으면 로드
    if TOKEN_FILE.exists():
        with open(TOKEN_FILE, 'rb') as token:
            creds = pickle.load(token)
    
    # 토큰이 없거나 만료되었으면 새로 인증
    if not creds or not creds.valid:

Static analysis

No suspicious patterns detected.