Workspace 工具协议免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.1

Overview

The skill is a plausible Google Workspace helper, but it asks users to install and auto-run an unpinned third-party MCP package that handles OAuth tokens and sensitive Workspace data, with weak credential-safety guidance.

Review this skill carefully before installing. Use it only if you trust the @presto-ai/google-workspace-mcp package and can pin or otherwise verify the exact version you run. Treat the Google OAuth token directory and any downloaded files as sensitive, avoid copying tokens to remote or shared hosts, and prefer a contained environment with least-privilege Google scopes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:95

Finding

Unpinned Third-Party Package Is Automatically Retrieved and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:95-96
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: High

Vulnerable Code

bash

npm install -g @presto-ai/google-workspace-mcp
mcporter config add google-workspace --command "npx" --arg "-y" --arg "@presto-ai/google-workspace-mcp" --scope home

Technical Analysis

The documented installation and configuration commands refer to @presto-ai/google-workspace-mcp without an exact version. Consequently, the package registry determines which release is installed and executed at the time each user follows these instructions.

The first command installs the package globally, modifying the user's environment. The second configures npx -y to retrieve and execute the package automatically without interactive confirmation. The effective executable is not included in this project and could change after the skill has been reviewed. No lockfile, package integrity hash, signature validation, or trusted release reference is supplied.

This dependency is particularly sensitive because the skill directs users to authorize access to Gmail, Calendar, Drive, Docs, and Sheets. A compromised package release would therefore execute with the local user's operating-system privileges and could potentially receive OAuth credentials and private Workspace content.

Attack Path

1. An attacker compromises the package publisher account, registry distribution path, or an unpinned future package release.
2. The attacker publishes a modified version containing malicious installation or runtime behavior.
3. A user follows the instructions in SKILL.md.
4. npm install or the configured npx -y command resolves the attacker-controlled version because no exact version is specified.
5. The package executes under the user's local account.
6. When the user completes OAuth authorization, the compromised package can attempt to access tok ...[truncated 921 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to one reviewed, immutable version in every installation and execution command:

   bash

   npm install -g @presto-ai/google-workspace-mcp@1.0.0
   mcporter config add google-workspace --command "npx" --arg "--no-install" --arg "@presto-ai/google-workspace-mcp@1.0.0" --scope home
   

   The example version must be replaced with the specific version that has actually been reviewed.

2. Avoid combining a global installation with an independently resolving npx command. Execute only the already installed and verified binary, or use a project-local dependency controlled by a lockfile.

3. Do not use automatic package acceptance through npx -y for a component handling OAuth credentials and sensitive account data.

4. Commit and enforce a lockfile where project-local package installation is possible. Use deterministic installation such as npm ci.

5. Verify registry integrity metadata, package provenance, signatures, and the publisher identity before installation.

6. Document the package's official source repository, expected checksum or integrity value, reviewed version, and required OAuth scopes.

7. Run the MCP package with least privilege and isolate it from unrelated local files, secrets, and environment variables where supported.

8. Review each dependency update before changing the pinned version, particularly installation scripts and code that handles OAuth tokens or outbound network requests.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:163

Finding

Unsafe Manual Transfer of Stored OAuth Credentials to Remote Hosts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:163
Vulnerability Type: Insecure OAuth credential handling guidance
Risk Level: Medium

Vulnerable Instruction

The complete instruction at this location states, in English translation:

text

If the browser does not open for first-time authorization, confirm that a
default browser is configured and that the environment is not headless.
For remote SSH scenarios, authorize locally and then copy the
./.config/google-workspace-mcp/ directory.

Lines 33 and 179 separately identify ./.config/google-workspace-mcp/ as the location where credentials are stored.

Technical Analysis

The skill recommends copying the entire credential-storage directory from one system to a remote SSH host. It does not specify:

• An authenticated and encrypted transfer method.
• Restrictive permissions for the source or destination.
• Validation that the remote host is trusted.
• Exclusion from repositories, backups, logs, and shared directories.
• Removal of temporary copies.
• Token rotation or revocation after suspected exposure.

OAuth token material may remain valid independently of the user's password and may permit continued API access until expiration or revocation. Copying the complete configuration directory also risks transferring additional metadata or secrets beyond the minimum material required.

Attack Path

1. A user authorizes the MCP package on a local workstation.
2. OAuth credentials are stored in ./.config/google-workspace-mcp/.
3. Following the documented remote-SSH workaround, the user copies the entire directory to a remote host.
4. The directory is transferred through an unsafe mechanism, placed at a permissive destination, included in backups, or left accessible to other users or processes on that host.
5. An attacker with access to the transfer channel, destination host, backup, shared directory, or accidental repository copy ...[truncated 921 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to copy the credential directory. Prefer an OAuth device-authorization or remote callback flow designed for headless environments.

2. Require users to authorize independently on the destination host rather than transferring reusable credentials whenever the provider supports that workflow.

3. If credential transfer is unavoidable, document an authenticated and encrypted mechanism such as carefully configured scp or sftp; never recommend plaintext transfer or shared storage.

4. Require restrictive permissions on both systems:

   bash

   chmod 700 ./.config/google-workspace-mcp
   find ./.config/google-workspace-mcp -type f -exec chmod 600 {} \;
   

5. Require the destination to be outside source repositories, web roots, shared directories, and broadly backed-up locations. Add the credential directory to applicable ignore rules.

6. Verify the identity and security posture of the remote host before transferring credentials. Shared or untrusted remote systems should not receive the tokens.

7. Transfer only the minimum credential file required rather than the entire configuration directory, if supported by the package.

8. Delete temporary archives and intermediate copies securely after transfer, and warn users not to expose credential paths or contents in terminal output and logs.

9. Document immediate token revocation through auth.clear and the Google account security controls when exposure is suspected.

10. Request only the minimum OAuth scopes required for the selected read-only operations and clearly display those scopes before authorization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

summary_zh: "免Google Cloud Console配置,OAuth登录即用Gmail/Calendar/Drive/Docs/Sheets的基础读取能力,覆盖邮件检索、日程查看、文件下载与文档表格,提供核心能力"
license: "MIT"
description: "|-. 适用于需要google workspace mcp相关能力的开发场景,包含结构化的工作流程和可复用的模板,帮助用户快速完成任务并保持代码质量.该技能适用于相关开发场景,包含结构化的工作流程和配置指引.经过深度差异化处置,针对用户反馈和使用痛点进行了改进,提升了实用性和可操作性.该技能适用于相关开发场景,包含结构化的工作流程和配置指引.经过深度差异化处置,针对用户反馈和使用痛点进行了改进,提升了实用性和可操作性."
  通过 @presto-ai/google-workspace-mcp 以纯OAuth登录方式访问Google Workspace,跳过Cloud Console建项目、启用API、下载client_secret.json等繁琐步骤。免费版提供Gmail邮件搜索与读取、Calendar日程查看、Drive文件检索与下载、Docs文档检索与文本提取、Sheets表格区域读取等基础能力,适合个人开发者体验Google Workspace自动化办公。写入、发送、会议创建、Chat与Slides等高级能力见付费版.
tags:
  - 通用办公
  - google

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

summary_zh: "免Google Cloud Console配置,OAuth登录即用Gmail/Calendar/Drive/Docs/Sheets的基础读取能力,覆盖邮件检索、日程查看、文件下载与文档表格,提供核心能力"
license: "MIT"
description: "|-. 适用于需要google workspace mcp相关能力的开发场景,包含结构化的工作流程和可复用的模板,帮助用户快速完成任务并保持代码质量.该技能适用于相关开发场景,包含结构化的工作流程和配置指引.经过深度差异化处置,针对用户反馈和使用痛点进行了改进,提升了实用性和可操作性.该技能适用于相关开发场景,包含结构化的工作流程和配置指引.经过深度差异化处置,针对用户反馈和使用痛点进行了改进,提升了实用性和可操作性."
  通过 @presto-ai/google-workspace-mcp 以纯OAuth登录方式访问Google Workspace,跳过Cloud Console建项目、启用API、下载client_secret.json等繁琐步骤。免费版提供Gmail邮件搜索与读取、Calendar日程查看、Drive文件检索与下载、Docs文档检索与文本提取、Sheets表格区域读取等基础能力,适合个人开发者体验Google Workspace自动化办公。写入、发送、会议创建、Chat与Slides等高级能力见付费版.
tags:
  - 通用办公
  - google

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill repeatedly markets the free edition as 'read-only', yet it explicitly supports actions that modify local state or auth state, including downloading files to disk and clearing/refreshing OAuth credentials. This mismatch can mislead users and downstream agents into granting broader trust than warranted, increasing the chance of unintended local writes or credential-affecting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents storing OAuth credentials locally and downloading Workspace files to arbitrary local paths, but it does not clearly warn about privacy, persistence, or the sensitivity of cached tokens and downloaded content. In this context, the skill handles email, documents, calendars, and drive files, so weak disclosure materially raises the risk of sensitive data being left on disk or exposed to other local processes/users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section states the free version only exposes read tools, but the listed tools include local file download and credential-management operations. In a skill ecosystem, inaccurate capability claims are security-relevant because agents or users may treat the skill as low-risk and invoke it without safeguards appropriate for write or auth-changing actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The FAQ/limits reinforce the claim that the free version is read-only even though the document elsewhere authorizes downloads and credential operations. Repeated contradictory statements amplify the risk of operator misunderstanding, especially when the skill is intended for use across multiple agent platforms.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The skill name, summaries, tags, and most user-facing instructions are presented in Chinese, while the file also claims broad applicability across arbitrary agent platforms. There is no explicit language-selection option or statement that the skill is intended specifically for Chinese-speaking users, which can violate a language/locale policy requiring opt-in or documented justification.

Content

No source excerpt is available for this finding.