google-workspace

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to accept raw OAuth client ID/secret or auth codes from the user and to write/run commands that embed those values (e.g., creating a JSON file from pasted client_id/client_secret and running --auth-code with the user-provided code), which requires outputting secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/google_api.py, the required runtime workflow can read outsider-authored free text from Gmail/Docs/Drive/Calendar by calling gmail_search/gmail_get, which fetches message bodies and other content from the user’s accounts into the program for LLM handling.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.50). The skill largely operates on user-level files and OAuth tokens, but it explicitly instructs modifying the macOS Calendar database directly via sqlite3 (~/Library/Group Containers/.../Calendar.sqlitedb), which changes local system application state and can corrupt/alter the host environment without explicit user safeguards.