Security audit
Security checks for vulnerabilities and agentic risk
Review is recommended because the login flow exposes sensitive authorization codes and the formatting command can bypass deletion safeguards.
Before connecting an important account, request a protected login callback that keeps authorization codes out of chat, formatting restricted to formatting operations, and narrower file access where possible. The delete command permanently removes files rather than moving them to trash, as documented by [Google](https://developers.google.com/workspace/drive/api/reference/rest/v3/files/delete). Disconnect through Google account permissions when finished; local logout alone does not revoke access.
scripts/gdrive_connect.pyUnclaimed loopback callback without PKCE permits OAuth code theft
The attacker can redeem the intercepted code before the owner, obtaining access and potentially an offline refresh token for the requested full Drive and Sheets scopes. This permits unauthorized reading, modification, and deletion of accessible Google files.
The exchange destination can be replaced through GD_EXCHANGE_ENDPOINT without validating its scheme or host, and the request includes the authorization code and client credentials. If an attacker can influence this configuration, sensitive material can be sent to an attacker-controlled endpoint or over plaintext HTTP; ordinary exchange with Google's default endpoint is legitimate.
url, data=body, headers={"Content-Type": "application/x-www-form-urlencoded"}
)
try:
with urllib.request.urlopen(req, timeout=timeout) as r:
return json.loads(r.read().decode() or "{}"), None
except urllib.error.HTTPError as e:
raw = e.read().decode(errors="replace")
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def get_json(url, session_value, timeout=30):
req = urllib.request.Request(url, headers={"Authorization": "Bearer " + session_value})
try:
with urllib.request.urlopen(req, timeout=timeout) as r:
return json.loads(r.read().decode() or "{}"), None
except urllib.error.HTTPError as e:
raw = e.read().decode(errors="replace")
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers={"Content-Type": "application/x-www-form-urlencoded"},
)
try:
with urllib.request.urlopen(req, timeout=30) as r:
res = json.loads(r.read().decode())
except urllib.error.HTTPError as e:
out(f"❌ Làm mới phiên thất bại (HTTP {e.code}): {e.read().decode(errors='replace')[:300]}")
The authorization and local session-storage behavior matches part of the description, but the supplied code does not implement the advertised end-to-end Sheets test. Its successful authorization path only calls Drive's about endpoint. The claim that Cloud Console is unnecessary is also conditional on obtaining suitable OAuth app credentials elsewhere, a prerequisite the description does not disclose. No unrelated malicious activity is evident in this chunk.
File discovery, reading, editing, and explicit deletion are documented capabilities, so those alone do not substantiate a hidden-purpose claim. However, the identified unrestricted batchUpdate implementation behind 'format' permits destructive operations that bypass the skill's stated deletion-confirmation boundary.
The format command forwards arbitrary Sheets batchUpdate requests without checking their operation types or invoking the deletion guard. A deleteSheet request can therefore remove a tab without --yes, and other requests can overwrite data while being presented as formatting.
The manifest describes connecting an OAuth session and testing creation, writing, and formatting of a Sheet. L300-L304 instead provide a general Drive DELETE operation on a caller-supplied file ID, with no restriction to spreadsheets or resources created by the test; this can permanently delete unrelated accessible Drive files, subject to the session's actual permissions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Cách B — bằng tay (nếu không dùng agent):
mkdir -p ~/.config/gdrive-connect && chmod 700 ~/.config/gdrive-connect
printf '{"client_id":"%s","client_sec":"%s"}' "$CLIENT_ID" "$CLIENT_SECRET" > ~/.config/gdrive-connect/app.json
chmod 600 ~/.config/gdrive-connect/app.json
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Client se… trên màn hình).mkdir -p ~/.config/gdrive-connect && chmod 700 ~/.config/gdrive-connect
printf '{"client_id":"%s","client_sec":"%s"}' "$CLIENT_ID" "$CLIENT_SECRET" > ~/.config/gdrive-connect/app.json
chmod 600 ~/.config/gdrive-connect/app.json
The instructions place a live OAuth authorization code in chat, exposing it to chat retention, logging, and anyone able to access the conversation. Before redemption or expiry, an intercepted code may be exchanged for account-access tokens; the desktop application's shared client secret is not an effective confidentiality boundary.
Without declared permissions the skill's intent is opaque and cannot be validated.
The connector requests full Drive access rather than limiting access to files created or explicitly selected for the application. Although broader Drive operations are documented, making this the default substantially increases the consequences of token theft, agent misuse, or prompt injection beyond the basic connection and spreadsheet-creation workflow.
The program explicitly asks the user to paste a callback URL containing a live authorization code into chat. The flow uses no PKCE challenge, so someone obtaining that code and the distributed desktop client credentials could race its redemption and obtain tokens with broad Drive access.
The manifest promises that the agent saves the session and tests creating, writing, and formatting a real Sheet. After saving the session, L235-L254 only retrieve account identity and storage quota through Drive's about endpoint; the file implements no spreadsheet creation, value updates, or formatting requests, so successful connection does not verify the advertised write capabilities.
The safety rule at L021 states that deletion runs only with --yes or GDRIVE_ALLOW_DELETE=1. These DELETE calls execute without checking either condition, and the selftest parser at L441-L442 does not offer --yes; although limited to newly created test resources, this directly contradicts the stated guarantee.
No suspicious patterns detected.