Google Workspace CLI

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:41 AM UTC
• Version: 1.0.3

Overview

This skill is a high-power Google Workspace automation guide, but its sensitive access is disclosed, purpose-aligned, and paired with meaningful guardrails.

Install only if you are comfortable granting gws the Google Workspace scopes needed for your workflow. Prefer narrow OAuth scopes, explicit --account use, dry-run-first write policy, and pinned/audited dependency versions where your installer supports them. Be especially careful with admin APIs, bulk mail, public or domain-wide sharing, MCP write exposure, and unattended jobs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned npm Dependency Creates a Mutable Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

' ``` 2. Require integrity verification using an npm lockfile, package digest, or equivalent mechanism supported by the Skill installer. 3. Avoid floating tags and semantic version ranges for security-sensitive command-line tools. 4. Review package provenance, publisher identity, release signatures, and repository ownership before updating the pinned version. 5. Test dependency updates in an isolated environment before deployment. 6. Disable npm lifecycle scripts during installation where compatible with the package, or explicitly audit every required lifecycle script. 7. Run the CLI under a least-privileged local account and grant only the minimum Google OAuth scopes required for each workflow. 8. Treat version changes as security-relevant changes requiring a new audit, especially because this dependency processes OAuth credentials and sensitive Workspace data. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

| https://www.googleapis.com/discovery/v1/apis | service/version identifiers | fetch API discovery documents |
| https://www.googleapis.com | request params, request bodies, and auth headers | execute Google Workspace API operations |
| https://accounts.google.com | OAuth browser consent metadata | user OAuth authorization flow |
| https://oauth2.googleapis.com | OAuth token exchange and refresh traffic | access token lifecycle |
| https://<service>.googleapis.com/$discovery/rest | discovery fallback requests | resolve APIs not served by standard discovery path |

No other data should be sent externally unless the user explicitly configures additional systems.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- bypass workspace governance policies or scope controls

Guardrails:
- Never ask users to paste refresh tokens, service account private keys, or OAuth client secrets into chat
- Never mix unrelated tenants under one default account
- Never run mutation commands when account ownership is unclear
- Never store unencrypted credentials in shared workspaces

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 75% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · drive.md (reported line 31)May include surrounding context.

md

|-----------|------|-------|
| Upload binary | `files.create` + `--upload ./file` | Set `parents` in metadata or it lands in root |
| Upload → Google format | same, with target `mimeType` in metadata (e.g. `application/vnd.google-apps.document`) | Server-side conversion on ingest |
| Download binary | `files.get` with `"alt": "media"` | No size cap concerns of export |
| Export Google-native | `files.export` with target `mimeType` | Caps at 10 MB of exported content (SKILL.md Per-API Limits) |

Export format traps: Sheets → `text/csv` exports only the FIRST sheet — per-sheet CSV needs one export per sheet or the Sheets values API (`editors.md`); Docs → pdf/docx/txt/html; Slides → pdf/pptx. Oversized Docs: export per-section or switch target format.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly recommends sharing generated Slides/Docs with sendNotificationEmail: false, which suppresses the normal user-facing signal that access was granted or changed. In a Google Workspace automation context, silent sharing can enable unnoticed disclosure of documents to unintended recipients, especially in bulk workflows such as contract generation or report distribution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The section provides operational guidance for bulk sending and notes drafts as a review step, but it does not clearly require explicit user confirmation, recipient verification, rate limiting safeguards, or policy checks before sending at scale. In a high-privilege Google Workspace automation skill, this omission can enable accidental mass email, phishing-like misuse, or disruptive outbound campaigns if an agent follows the instructions too literally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phrase 'silent, on first write need' authorizes automatic initialization and state-changing filesystem actions without an explicit user confirmation step. In an agent skill, broad auto-init triggers can cause unintended writes, migration of prior data, or permission changes simply from routine use, which is risky because the skill handles sensitive Workspace account and tenant metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructions direct the agent to silently create multiple files and change permissions in the user's home directory, but this behavior is not surfaced as a user-visible warning in the skill description. Hidden persistence and permission changes are dangerous in agent contexts because they establish long-lived local state containing sensitive accounts, tenants, and command patterns without informed consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 21)May include surrounding context.

bash

mkdir -p ~/Clawic/data/google-workspace-cli
touch ~/Clawic/data/google-workspace-cli/{config.yaml,memory.md,command-log.md,change-control.md,incidents.md,mcp-profiles.md}
chmod 700 ~/Clawic/data/google-workspace-cli
chmod 600 ~/Clawic/data/google-workspace-cli/*

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 22)May include surrounding context.

mkdir -p ~/Clawic/data/google-workspace-cli touch ~/Clawic/data/google-workspace-cli/{config.yaml,memory.md,command-log.md,change-control.md,incidents.md,mcp-profiles.md} chmod 700 ~/Clawic/data/google-workspace-cli chmod 600 ~/Clawic/data/google-workspace-cli/*

text

If `memory.md` is empty, seed it from `memory-template.md`. The tight permissions matter: these files name accounts, tenants, and command patterns.

Static analysis

No suspicious patterns detected.