gdcli
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@mariozechner/gdclipackage from the public NPM registry. This package is maintained by the skill author. - [COMMAND_EXECUTION]: The skill executes shell commands using the
gdclitool to interact with the Google Drive API for file management, searching, and sharing. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data retrieved from external Google Drive queries and file searches.
- Ingestion points: Data enters the agent's context through the output of commands like
gdcli searchandgdcli ls --queryinSKILL.md. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious instructions embedded in file names or content.
- Capability inventory: The agent has the ability to download files, upload files, and modify sharing permissions via the
gdclitool. - Sanitization: No sanitization or filtering logic is specified for the data returned from the Google Drive API.
Audit Metadata