Security audit

Workspace 工具协议免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill presents itself as a free read-focused Google Workspace helper, but its install path exposes broader Google account permissions and write-capable tools than the skill clearly discloses.

Review this carefully before installing. Only authorize a Google account you are comfortable exposing to a third-party MCP server with broad Workspace scopes, and do not assume the installed package is limited to read-only use. Prefer a dedicated test account or a tightly controlled Workspace account, and verify the exact OAuth consent scopes before granting access.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill repeatedly markets itself as 'read-only' while also documenting actions that mutate the local environment, including downloading files to disk and managing stored OAuth credentials. This mismatch can mislead users and agents into granting broader trust than warranted, increasing the chance of unintended file writes or credential state changes.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The core capabilities section labels the free tools as read-focused, but includes `auth.clear` and `auth.refreshToken`, which alter authentication state, and `drive.downloadFile`, which writes files locally. Misclassifying these actions reduces informed consent and can cause an agent to perform side-effecting operations under a read-only assumption.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The examples present the skill as suited for passive information retrieval, but include downloading Drive content to a local path, which is a local write with persistence implications. While not inherently malicious, the framing can cause users to underestimate the consequences of using the example workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation encourages downloading Google Drive files to arbitrary local paths without a clear warning that this writes potentially sensitive Workspace data onto the host filesystem. In an agent context, that can lead to unintentional data persistence, overwrite risks, or disclosure through insecure directories and later processing.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill requests browser-based Google OAuth and stores reusable credentials locally, but does not provide a prominent privacy and persistence warning. In a multi-tool agent environment, silently persisted tokens can grant ongoing access to Gmail, Calendar, Drive, Docs, and Sheets beyond the user's immediate expectation, materially increasing account and data exposure.

Static analysis

No suspicious patterns detected.