connector-googledrive
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill describes a standard OAuth 2.0 PKCE flow for Google Drive integration. It encourages best practices such as using specific client libraries rather than manually constructing HTTP requests and recommends the principle of least privilege for requested API scopes.
- [INDIRECT_PROMPT_INJECTION]: The skill defines methods to ingest data from an external source (Google Drive), such as listing files and reading metadata, which represents a potential attack surface for indirect instructions.
- Ingestion points: File listings and metadata are retrieved via the
googledrive-clientresource groups defined inSKILL.md(e.g.,drive.files.list,drive.files.get). - Boundary markers: The provided documentation and code examples do not specify the use of delimiters or boundary markers for data retrieved from the Drive API.
- Capability inventory: The skill facilitates comprehensive file management across multiple resource groups (files, permissions, comments, drives) as detailed in
SKILL.md. - Sanitization: No explicit sanitization or validation of the external metadata is described in the implementation patterns.
Audit Metadata