skills/gengwg/skills/gdrive-offload/Gen Agent Trust Hub

gdrive-offload

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes rclone and standard Unix utilities such as rm, xargs, and ls to manage file transfers and cleanup. It follows shell best practices, including the use of the -- delimiter and newline-based xargs processing (-d '\n'), to prevent argument injection or errors when handling filenames containing spaces, newlines, or leading dashes.- [DATA_EXFILTRATION]: The skill is designed to transfer data to external storage; however, it targets a user-configured rclone remote (gdrive:). The data movement is the primary stated purpose of the skill, and no evidence of unauthorized exfiltration to untrusted third-party domains was found.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local filenames which could theoretically contain malicious instructions.
  • Ingestion points: Local filenames in the user-specified directory.
  • Boundary markers: The skill requires the agent to display the full inventory of files to the user and obtain explicit confirmation before any deletion occurs.
  • Capability inventory: File system removal (rm), remote file transfer (rclone), and directory listing (ls).
  • Sanitization: The skill uses defensive techniques like generating a manifest file (--files-from) and using shell argument separators (--) to ensure filenames are treated strictly as data and not as executable commands or flags.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 06:45 PM