google-workspace

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly tells the agent to accept raw client ID/client secret or OAuth auth codes from the user and to write them into a JSON file or embed them verbatim in commands (e.g., --auth-code "THE_URL_OR_CODE"), which requires outputting sensitive secret values directly and creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's documentation and runtime scripts (e.g., SKILL.md and scripts/google_api.py functions like gmail_search/gmail_get, docs_get, drive_search, sheets_get) explicitly fetch and parse Gmail messages, Google Docs/Drive/Sheets content — which are untrusted, user-generated third‑party content tied to external senders — and the agent is expected to read and can act on that content (e.g., reply/send emails, create events), so such content could materially influence tool use and decisions.