Google Docs from Markdown

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:26 AM UTC
• Version: 1.0.1

Overview

The skill's Google Docs workflow is coherent, but it should be reviewed because its helper script can run an unverified converter from a predictable /tmp path before uploading content to Google Drive.

Install only if you intend selected Markdown content to be uploaded to Google Drive through your authenticated gog account. Prefer installing pandoc through a trusted package manager and updating the script to use that binary, or require checksum verification and a user-owned cache path before running it, especially on shared machines.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/gdocs-create.sh:38
• Finding: Unverified Download and Execution of Pandoc Binary<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gdocs-create.sh`, lines 38–57 **Vulnerability Type**: Unverified third-party executable download **Risk Level**: Medium ### Vulnerable Code ```bash # Setup pandoc PANDOC_BIN="/tmp/pandoc-3.1.11/bin/pandoc" if [ ! -f "$PANDOC_BIN" ]; then echo -e "${YELLOW}Downloading pandoc...${NC}" cd /tmp wget -q https://github.com/jgm/pandoc/releases/download/3.1.11/pandoc-3.1.11-linux-amd64.tar.gz tar xzf pandoc-3.1.11-linux-amd64.tar.gz rm pandoc-3.1.11-linux-amd64.tar.gz echo -e "${GREEN}Pandoc installed to $PANDOC_BIN${NC}" fi # Create temp docx file TMP_DIR=$(mktemp -d) DOCX_FILE="$TMP_DIR/${DOC_TITLE// /_}.docx" echo -e "${YELLOW}Converting Markdown to DOCX...${NC}" "$PANDOC_BIN" "$MD_FILE" -o "$DOCX_FILE" ``` ### Technical Analysis The script downloads a precompiled Pandoc archive and subsequently executes the extracted binary without verifying a cryptographic checksum or digital signature. The URL points to Pandoc's official GitHub release rather than a personal paste or code-hosting account, and the version is pinned to `3.1.11`; however, pinning a URL does not verify the integrity or authenticity of the downloaded bytes. If the release artifact, hosting account, network trust chain, or local certificate trust store is compromised, an altered archive could install attacker-controlled executable code. The archive is extracted immediately, and the resulting binary is trusted solely because it exists at the expected path. Automatic executable acquisition supports the declared conversion workflow, but it is not the minimum-risk design. Requiring a trusted system installation or verifying the downloaded release would reduce the supply-chain exposure. ### Attack Path 1. An attacker compromises the upstream release asset, its hosting account, or the victim's network or TLS trust environment. 2. The victim invokes the Skill on a system where `/tmp/pandoc-3.1.11/bin/pandoc` does ...[truncated 768 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a Pandoc installation supplied by a trusted operating-system package manager, or require users to install Pandoc before invoking the Skill. 2. If automatic downloading is retained, pin and verify an official SHA-256 or stronger checksum before extraction. 3. Where upstream signatures are available, verify the release signature against a pinned, trusted signing key. 4. Download the archive into a private directory created with `mktemp -d`, rather than directly into shared `/tmp`. 5. Use strict download options such as `wget --https-only` and fail closed on download or verification errors. 6. Extract the archive only after successful integrity verification. 7. Keep the checksum and version update process explicit and reviewable. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gdocs-create.sh:38
• Finding: Predictable Shared Temporary Path Allows Local Binary Planting<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gdocs-create.sh`, lines 38–57 **Vulnerability Type**: Unsafe use of a predictable executable path in shared `/tmp` **Risk Level**: High in multi-user environments ### Vulnerable Code ```bash # Setup pandoc PANDOC_BIN="/tmp/pandoc-3.1.11/bin/pandoc" if [ ! -f "$PANDOC_BIN" ]; then echo -e "${YELLOW}Downloading pandoc...${NC}" cd /tmp wget -q https://github.com/jgm/pandoc/releases/download/3.1.11/pandoc-3.1.11-linux-amd64.tar.gz tar xzf pandoc-3.1.11-linux-amd64.tar.gz rm pandoc-3.1.11-linux-amd64.tar.gz echo -e "${GREEN}Pandoc installed to $PANDOC_BIN${NC}" fi # Create temp docx file TMP_DIR=$(mktemp -d) DOCX_FILE="$TMP_DIR/${DOC_TITLE// /_}.docx" echo -e "${YELLOW}Converting Markdown to DOCX...${NC}" "$PANDOC_BIN" "$MD_FILE" -o "$DOCX_FILE" ``` ### Technical Analysis The script stores and executes Pandoc from the globally predictable path `/tmp/pandoc-3.1.11/bin/pandoc`. Before execution, it checks only whether the path refers to a regular file. It does not verify the file's owner, permissions, cryptographic digest, or origin. On a multi-user system, another local user or an earlier untrusted process may be able to create the expected directory and executable before the victim runs the script. Once the file exists, the download branch is skipped and the pre-positioned executable is invoked. The use of `mktemp -d` for the generated DOCX workspace is appropriate, but it does not protect the separately managed Pandoc executable. ### Attack Path 1. A local attacker predicts the hardcoded path `/tmp/pandoc-3.1.11/bin/pandoc`. 2. Before the victim invokes the Skill, the attacker creates the expected directory structure and places a malicious executable at that path. 3. The victim runs `gdocs-create.sh`. 4. The `[ ! -f "$PANDOC_BIN" ]` condition evaluates as false, so the script skips the legitimate download. 5. The script executes the attacker-planted binary with the vict ...[truncated 516 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store reusable executables under a predictable shared `/tmp` path. 2. Use a user-owned cache directory, such as an appropriate location under `$XDG_CACHE_HOME`, and create it with restrictive permissions. 3. Verify the executable's cryptographic checksum before every use. 4. Confirm that the executable and all parent directories are owned by the current user and are not writable by other users. 5. If the binary is needed only for one invocation, create a private directory with `mktemp -d`, download and verify the archive there, execute it, and remove the directory afterward. 6. Use `test -x` in addition to integrity and ownership checks; an executability check alone is not sufficient. 7. Consider eliminating automatic installation and using a trusted `pandoc` discovered through `command -v`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gdocs-create.sh:22
• Finding: Document Title Allows Output Path Traversal<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gdocs-create.sh`, lines 22–57 **Vulnerability Type**: Path traversal through an insufficiently sanitized filename **Risk Level**: Medium ### Vulnerable Code ```bash MD_FILE="$1" DOC_TITLE="${2:-$(basename "$MD_FILE" .md)}" # Check if markdown file exists if [ ! -f "$MD_FILE" ]; then echo -e "${RED}Error: File not found: $MD_FILE${NC}" exit 1 fi # Check for gog CLI if ! command -v gog &> /dev/null; then echo -e "${RED}Error: gog CLI not found. Please install gog first.${NC}" exit 1 fi # Setup pandoc PANDOC_BIN="/tmp/pandoc-3.1.11/bin/pandoc" if [ ! -f "$PANDOC_BIN" ]; then echo -e "${YELLOW}Downloading pandoc...${NC}" cd /tmp wget -q https://github.com/jgm/pandoc/releases/download/3.1.11/pandoc-3.1.11-linux-amd64.tar.gz tar xzf pandoc-3.1.11-linux-amd64.tar.gz rm pandoc-3.1.11-linux-amd64.tar.gz echo -e "${GREEN}Pandoc installed to $PANDOC_BIN${NC}" fi # Create temp docx file TMP_DIR=$(mktemp -d) DOCX_FILE="$TMP_DIR/${DOC_TITLE// /_}.docx" echo -e "${YELLOW}Converting Markdown to DOCX...${NC}" "$PANDOC_BIN" "$MD_FILE" -o "$DOCX_FILE" ``` ### Technical Analysis The optional document title is incorporated into the DOCX output path. The script replaces spaces with underscores but does not remove path separators or reject `..` path components. Consequently, a crafted title can cause the normalized output path to resolve outside the private temporary directory. Shell quoting correctly prevents the title from being interpreted as shell syntax, so this is not command injection. Quoting does not, however, prevent filesystem path traversal. Pandoc may create or overwrite the resolved `.docx` file wherever the invoking user has write permission. If the output escapes `TMP_DIR`, the final `rm -rf "$TMP_DIR"` cleanup will not delete it. ### Attack Path 1. An attacker controls or influences the document-title argument passed to the script. 2. The attacker suppli ...[truncated 918 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not derive the filesystem output path directly from the display title. 2. Generate the DOCX path independently using `mktemp`, for example with a fixed safe template inside `TMP_DIR`. 3. Preserve `DOC_TITLE` only as display metadata rather than using it as a filename. 4. If a title-based filename is required, apply a strict allowlist such as ASCII letters, digits, periods, underscores, and hyphens. 5. Explicitly remove or reject `/`, backslashes, null-equivalent input, and `.` or `..` path components. 6. Canonicalize the resulting path and verify that it remains beneath the canonical temporary-directory path before invoking Pandoc. 7. Retain quoting around all path variables after implementing validation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents shell-based behavior and explicitly instructs users to run a local script, but it does not declare any tool scope such as allowed shell access. This weakens security boundaries and reviewability because the agent may invoke shell-capable actions without an explicit permission contract, increasing the chance of unintended command execution or unsafe script use.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: gdocs-markdown
description: Create Google Docs from Markdown files. Use when the user wants to create a Google Doc from Markdown content, or when working with gog CLI and need to populate Google Docs with content. This skill handles the conversion Markdown → DOCX → Google Docs via Drive upload, since gog docs CLI only supports create/export/cat/copy but NOT write/update content.
---

# Google Docs from Markdown

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is designed to upload Markdown-derived content to Google Drive/Google Docs, but it does not prominently warn users that document contents will leave the local environment and be sent to a third-party cloud service. This can lead to inadvertent disclosure of sensitive data if a user assumes the conversion is purely local.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script fetches and executes a third-party binary dependency at runtime from the network without signature or checksum verification, pinning only by URL and filename. This creates a supply-chain risk: a compromised release asset, DNS/TLS interception, or unexpected file replacement could result in execution of attacker-controlled code on the host running the skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script uploads the converted document to Google Drive, transmitting user-provided content to an external service, but it does not present a clear consent/confirmation step or prominent warning at the point of execution. In agent contexts, this can cause unintended disclosure of sensitive local file contents if the user did not realize the command performs a remote upload rather than only local conversion.

Static analysis

No suspicious patterns detected.