assist-google-setup
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote API which may contain user-controlled content, creating a potential vector for indirect prompt injection.
- Ingestion points: API responses from endpoints like
/api/google/accountsprocessed inscripts/google-axi.mjs. - Boundary markers: The skill employs a custom serialization format (TOON) that includes character escaping for quotes and control characters.
- Capability inventory: The skill can execute local commands and perform network requests to a configured server.
- Sanitization: The implementation uses an
escapeStringfunction for basic formatting, but lacks robust sanitization against adversarial prompt content in the data stream. - [COMMAND_EXECUTION]: The skill utilizes a bundled Node.js script (
scripts/google-axi.mjs) executed through a shell shim to perform all account operations. - [DATA_EXFILTRATION]: The script performs network operations using
fetch()to communicate with a backend server. By default, it connects tolocalhost, but the target can be redirected using theCLAUDE_ASSIST_SERVERenvironment variable.
Audit Metadata