Security audit

Google Docs from Markdown

Security checks for vulnerabilities and agentic risk

Overview

The skill's Google Docs workflow is coherent, but it should be reviewed because its helper script can run an unverified converter from a predictable /tmp path before uploading content to Google Drive.

Install only if you intend selected Markdown content to be uploaded to Google Drive through your authenticated gog account. Prefer installing pandoc through a trusted package manager and updating the script to use that binary, or require checksum verification and a user-owned cache path before running it, especially on shared machines.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: scripts/gdocs-create.sh:38
Finding: Unverified Download and Execution of Pandoc Binary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gdocs-create.sh:38
Finding: Predictable Shared Temporary Path Allows Local Binary Planting
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gdocs-create.sh:22
Finding: Document Title Allows Output Path Traversal
Content: View full analysis
/dev/null; then echo -e "${RED}Error: gog CLI not found. Please install gog first.${NC}" exit 1 fi # Setup pandoc PANDOC_BIN="/tmp/pandoc-3.1.11/bin/pandoc" if [ ! -f "$PANDOC_BIN" ]; then echo -e "${YELLOW}Downloading pandoc...${NC}" cd /tmp wget -q https://github.com/jgm/pandoc/releases/download/3.1.11/pandoc-3.1.11-linux-amd64.tar.gz tar xzf pandoc-3.1.11-linux-amd64.tar.gz rm pandoc-3.1.11-linux-amd64.tar.gz echo -e "${GREEN}Pandoc installed to $PANDOC_BIN${NC}" fi # Create temp docx file TMP_DIR=$(mktemp -d) DOCX_FILE="$TMP_DIR/${DOC_TITLE// /_}.docx" echo -e "${YELLOW}Converting Markdown to DOCX...${NC}" "$PANDOC_BIN" "$MD_FILE" -o "$DOCX_FILE" ``` ### Technical Analysis The optional document title is incorporated into the DOCX output path. The script replaces spaces with underscores but does not remove path separators or reject `..` path components. Consequently, a crafted title can cause the normalized output path to resolve outside the private temporary directory. Shell quoting correctly prevents the title from being interpreted as shell syntax, so this is not command injection. Quoting does not, however, prevent filesystem path traversal. Pandoc may create or overwrite the resolved `.docx` file wherever the invoking user has write permission. If the output escapes `TMP_DIR`, the final `rm -rf "$TMP_DIR"` cleanup will not delete it. ### Attack Path 1. An attacker controls or influences the document-title argument passed to the script. 2. The attacker suppli ...[truncated 918 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents shell-based behavior and explicitly instructs users to run a local script, but it does not declare any tool scope such as allowed shell access. This weakens security boundaries and reviewability because the agent may invoke shell-capable actions without an explicit permission contract, increasing the chance of unintended command execution or unsafe script use.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: gdocs-markdown description: Create Google Docs from Markdown files. Use when the user wants to create a Google Doc from Markdown content, or when working with gog CLI and need to populate Google Docs with content. This skill handles the conversion Markdown → DOCX → Google Docs via Drive upload, since gog docs CLI only supports create/export/cat/copy but NOT write/update content. --- # Google Docs from Markdown

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is designed to upload Markdown-derived content to Google Drive/Google Docs, but it does not prominently warn users that document contents will leave the local environment and be sent to a third-party cloud service. This can lead to inadvertent disclosure of sensitive data if a user assumes the conversion is purely local.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script fetches and executes a third-party binary dependency at runtime from the network without signature or checksum verification, pinning only by URL and filename. This creates a supply-chain risk: a compromised release asset, DNS/TLS interception, or unexpected file replacement could result in execution of attacker-controlled code on the host running the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script uploads the converted document to Google Drive, transmitting user-provided content to an external service, but it does not present a clear consent/confirmation step or prominent warning at the point of execution. In agent contexts, this can cause unintended disclosure of sensitive local file contents if the user did not realize the command performs a remote upload rather than only local conversion.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.