Google Colab

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Google Colab workflow helper that keeps local notes and asks the user to define activation and data boundaries before execution.

Install only if you want persistent local Colab workflow notes under ~/google-colab and are comfortable using Google Colab, Google APIs, GCS, and PyPI for notebook work. Do not connect sensitive datasets unless you have approved the source and handling boundaries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

- For notebook execution: Google account with Colab access
- For dataset mounting: explicit permission for Drive, GCS, or external endpoints

Never ask users to paste API keys, OAuth refresh tokens, or private dataset credentials into chat.

## Data Storage

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The auto-activation criteria are broad and ambiguous, covering generic terms like Colab, notebooks, runtime errors, or model training. In an agent setting, this can cause the skill to engage in unrelated contexts, increasing the chance of inappropriate persistence, unintended data capture into local memory files, or overreach into conversations where the user did not intend this skill to operate.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 34)May include surrounding context.

bash

mkdir -p ~/google-colab
touch ~/google-colab/{memory.md,notebooks.md,runtimes.md,datasets.md,incidents.md,experiments.md}
chmod 700 ~/google-colab
chmod 600 ~/google-colab/{memory.md,notebooks.md,runtimes.md,datasets.md,incidents.md,experiments.md}

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 35)May include surrounding context.

mkdir -p ~/google-colab touch ~/google-colab/{memory.md,notebooks.md,runtimes.md,datasets.md,incidents.md,experiments.md} chmod 700 ~/google-colab chmod 600 ~/google-colab/{memory.md,notebooks.md,runtimes.md,datasets.md,incidents.md,experiments.md}

text

5. If `memory.md` is empty, initialize from `memory-template.md`.