google-drive-upload

SUSPICIOUS. The skill’s purpose and capabilities are mostly aligned, but it uploads files through a custom Google Apps Script intermediary rather than directly to Google Drive’s official API. That makes the file contents and API key visible to a user-configured endpoint whose ownership and code are not verified by the skill. Risk is medium due to data-flow integrity concerns, not confirmed malware.