google-slides
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches and executes the
@useclawlink/clipackage from the NPM registry vianpxto facilitate the integration. - [COMMAND_EXECUTION]: Commands are executed through the
npxutility to manage authentication and interact with the Google Slides API. - [CREDENTIALS_UNSAFE]: The documentation indicates that authentication tokens are stored locally at
~/.clawlink/credentials.jsonfollowing the browser login process. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface through the
googleslides_create_slides_markdownaction, which processes external markdown content. The instructions do not define specific boundary markers or sanitization steps for this ingested data, although this is inherent to the tool's slide-creation capability.
Audit Metadata