Security audit

Gws Skill

Security checks across malware telemetry and agentic risk

Overview

This Google Workspace skill is transparent about its admin-investigation purpose, but it grants tenant-wide access to read and export sensitive user data with limited built-in safeguards.

Install only in a tightly controlled Workspace admin or legal-investigation environment. Use a dedicated service account, narrow delegated scopes where possible, protect and rotate the JSON key, restrict who can run the scripts, require ticketed approval before impersonating users or exporting Vault data, and add separate audit logging for every sensitive lookup or export.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill is designed to access highly sensitive cross-user Google Workspace data including email, Vault content, Drive, calendars, documents, contacts, and audit logs, but it does not present a prominent privacy/authorization warning or usage guardrails. In this context, omission of clear consent, legal-use, and data-handling boundaries increases the risk of misuse, overcollection, and unauthorized surveillance across an entire domain.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The checklist instructs users to create and persist a service-account JSON key for a highly privileged Google Workspace integration, but it does not clearly warn that this credential grants broad cross-domain read access when combined with domain-wide delegation. Long-lived key files are a common source of compromise through developer machines, backups, repositories, or misconfigured file sharing, and here exposure could enable mailbox, Vault, Drive, Calendar, and directory access across the tenant.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This script uses domain-wide delegation to impersonate an arbitrary user and retrieve that user's calendar data, then prints the resulting event contents directly to stdout. In a Google Workspace admin/investigation skill, that creates a real data-exposure risk because sensitive meeting titles, descriptions, attendees, and links can be accessed and exfiltrated without any approval gate, warning, redaction, or audit-oriented justification in the tool itself.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This code uses domain-wide delegation to search arbitrary users' Gmail accounts and returns message identifiers and counts with no in-code consent check, authorization boundary, or user-facing warning. In this skill's context, the capability is explicitly organization-wide and investigative, which makes misuse or overbroad access materially more dangerous because it enables silent mailbox surveillance across the domain.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script retrieves full email content, parses bodies, and prints the resulting data directly as JSON, which can expose highly sensitive communications and regulated data to any operator or downstream system consuming the output. Given this skill is designed for domain-wide delegated access, the absence of masking, warning, or policy enforcement significantly increases the risk of bulk privacy violations and unauthorized disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This code uses domain-wide delegation to impersonate arbitrary users and retrieve contact or directory data, then returns that personal information directly to the caller without any authorization checks, purpose limitation, masking, or audit/consent guardrails. In the context of a Google Workspace admin investigation tool, this is especially sensitive because the skill is explicitly designed for cross-user access across a domain, so misuse or prompt-driven abuse could expose employees' personal contacts, phone numbers, and organizational details at scale.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This script retrieves Google Workspace audit data and prints it directly to stdout as JSON, including actor email addresses, IP addresses, and event parameters that may contain sensitive organizational telemetry. In the context of a domain-wide delegation admin tool, unrestricted retrieval and disclosure of org-wide login, admin, Drive, token, and Gmail activity materially increases the risk of privacy violations, accidental over-collection, and leakage through logs, terminals, or downstream systems.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This script exposes Google Vault capabilities to search any user's mailbox, search entire organizational units, and export matching email content as MBOX, but the CLI provides no affirmative warning, justification prompt, or friction before highly sensitive content is queried or exported. In the context of a domain-wide delegation admin tool, that omission materially increases the risk of unauthorized insider use, accidental over-collection, and silent bulk exfiltration of regulated or privileged communications.

Unpinned Dependencies

Low

Category: Supply Chain
Content: google-auth google-auth-httplib2 google-api-python-client
Confidence: 95% confidence
Finding: google-auth

Unpinned Dependencies

Low

Category: Supply Chain
Content: google-auth google-auth-httplib2 google-api-python-client
Confidence: 95% confidence
Finding: google-auth-httplib2

Unpinned Dependencies

Low

Category: Supply Chain
Content: google-auth google-auth-httplib2 google-api-python-client
Confidence: 97% confidence
Finding: google-api-python-client

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.