Google Contacts Create

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.1

Overview

This is a narrow Google Contacts creation skill whose account-changing purpose is explicit, though users should add confirmation and duplicate checks before use.

Install only if you want an agent to create contacts in your configured Google account. Use a trusted `gog` binary, keep the Composio credential least-privilege where possible, and require explicit user approval plus a duplicate check before each contact is created.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly creates a new Google contact but does not warn that it will modify user data in an external account. This can cause users or orchestrators to invoke it without clear awareness of the side effect, increasing the risk of unintended data creation, duplication, or privacy-impacting changes in Google Contacts.

VirusTotal

65/65 vendors flagged this skill as clean.