google-workspace

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The setup asks the user to paste the full OAuth redirect URL or code and instructs the agent to run a command embedding that value (GSETUP --auth-code "THE_URL_OR_CODE..."), which requires the LLM to receive and output a sensitive OAuth code/URL verbatim, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime LLM context can include outsider-authored free text from Gmail/Calendar/Drive/Docs API responses (e.g., gmail get decodes message body text and docs get extracts document text, which the agent would then pass back into the LLM for reasoning), so outsider content is ingested as readable prose.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The setup script (scripts/setup.py) calls pip at runtime via subprocess.check_call([... sys.executable, "-m", "pip", "install", ...]) to install REQUIRED_PACKAGES, which fetches and executes code from PyPI (e.g. https://pypi.org) and is invoked automatically by _ensure_deps during normal operation, so the skill can download and execute remote code at runtime.