google-workspace-setup
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill describes a legitimate OAuth2 authorization process, including project configuration on the Google Cloud Console and token exchange using local scripts.
- [DATA_EXPOSURE]: The skill involves handling sensitive authentication files, such as
google_client_secret.jsonandgoogle_token.json, which are stored in the user's home directory (~/.hermes/). Accessing these paths is necessary for the skill's primary function of managing Google Workspace credentials. - [COMMAND_EXECUTION]: The instructions require the execution of local Python scripts (
setup.pyandgoogle_api.py) within a virtual environment. These scripts facilitate the OAuth flow and provide access to Google APIs (Gmail, Calendar, etc.). - [INDIRECT_PROMPT_INJECTION]: The skill mentions future integration with another skill (
market_alpha_scout) that performs web scraping of stock data. This indicates an attack surface where untrusted data from external websites could be ingested by the agent. However, this is noted as a risk factor for the integrated workflow and does not represent an active vulnerability in the current setup guide.
Audit Metadata