google

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:13 AM UTC
• Version: 1.0.0

Overview

This appears to be a real Google Drive integration, but it gives broad Drive read/write/delete/share authority and includes unsafe API-key troubleshooting guidance.

Install only if you trust Maton with Google Drive access and are comfortable routing Drive operations through its gateway. Do not print, paste, screenshot, or log MATON_API_KEY; rotate it if it has appeared in logs. Before any delete, overwrite, move, export, upload, or sharing action, require exact file IDs/names and explicit user confirmation, and revoke unused Google Drive connections when finished.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:526

Finding

API Key Exposed in Plaintext by Troubleshooting Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 526-531
Vulnerability Type: Plaintext sensitive credential exposure
Risk Level: Medium

Vulnerable code snippet:

markdown

1. Check that the `MATON_API_KEY` environment variable is set:

```bash
echo $MATON_API_KEY

text

### Technical Analysis

The troubleshooting instructions print the complete `MATON_API_KEY` bearer credential to standard output. Although the key is not hardcoded in the project, revealing its value is unnecessary when merely checking whether the environment variable is configured.

Terminal output may be retained in CI logs, agent tool transcripts, shell-session recordings, support records, screenshots, or screen-sharing sessions. Because the Skill uses this value as a bearer token in `Authorization` headers, possession of the exposed key may be sufficient to authenticate to Maton services.

The documented transmission of the key to `gateway.maton.ai` and `ctrl.maton.ai` is part of the declared managed-OAuth design. The vulnerability is the separate instruction to disclose the raw key in terminal output.

### Attack Path

1. A user encounters an authentication problem and follows the documented troubleshooting procedure.
2. The user runs `echo $MATON_API_KEY`.
3. The complete bearer credential appears in terminal output.
4. That output is captured in an agent transcript, CI log, support message, screenshot, terminal recording, or screen-sharing session.
5. An unauthorized party retrieves the exposed value.
6. The party submits it as a bearer credential to `gateway.maton.ai` or `ctrl.maton.ai`.
7. If the key remains valid, the party may perform operations allowed by the associated account and connected Google Drive authorization.

### Impact Assessment

Successful exploitation may expose the privileges associated with the Maton account and its active Google Drive connection. Depending on the OAuth permissions and accou
...[truncated 460 chars]

Remediation

View remediation

Remediation Suggestions

Replace the raw-value command with a presence-only check that never prints the secret:

bash

if [ -n "${MATON_API_KEY:-}" ]; then
  echo "MATON_API_KEY is set"
else
  echo "MATON_API_KEY is not set"
fi

Additional hardening measures:

• Explicitly warn users never to print, log, paste, or screenshot API keys.
• Recommend redacting authorization headers and secrets from diagnostic output.
• Ensure CI and agent environments mask MATON_API_KEY.
• Avoid shell tracing such as set -x while handling credentials.
• Recommend immediate rotation through Maton account settings if a key has appeared in logs, transcripts, screenshots, or support messages.
• Prefer short-lived, narrowly scoped credentials where supported.
• Document the data-security implications of routing Drive content through the Maton gateway so users can make an informed authorization decision.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The skill exposes a direct file deletion operation with no embedded guardrails, confirmation flow, or validation guidance. In a tool-using agent, this creates a high-risk parameter abuse path where a mistaken, injected, or ambiguous fileId can irreversibly delete user data.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

Delete File

bash

DELETE /google-drive/drive/v3/files/{fileId}

Copy File

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

md

file_path = '/path/to/large_file.bin'
file_size = os.path.getsize(file_path)

# Step 1: Initiate resumable upload session
url = 'https://gateway.maton.ai/google-drive/upload/drive/v3/files?uploadType=resumable'
metadata = json.dumps({'name': 'large_file.bin'}).encode()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents destructive and privacy-impacting capabilities such as deleting files, modifying content, exporting documents, uploading data, and changing sharing permissions without explicit warnings, confirmation requirements, or guidance to verify user intent. In an agent setting, this increases the chance that a model will carry out sensitive Drive actions from ambiguous prompts, causing data loss or unintended disclosure.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete connection_id instead of a placeholder.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: SKILL.md:103