Google Drive Download File

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.1

Overview

This is a simple Google Drive download helper whose behavior matches its stated purpose, with normal caution needed around where files are saved.

Install only if you trust the local gog CLI and have it authenticated to the intended Google account. Use explicit output paths in a safe folder, check for existing files before downloading, and treat downloaded Google Drive content as untrusted until you inspect or scan it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill explicitly instructs downloading a Google Drive file and writing it to an arbitrary local path, but its description and surrounding documentation do not warn that it performs a filesystem write using user-supplied parameters. In an agent setting, this missing warning can cause downstream planners or reviewers to underestimate the action's risk, increasing the chance of unintended overwrites, placement in sensitive locations, or unsafe handling of untrusted downloaded content.

VirusTotal

65/65 vendors flagged this skill as clean.