gdocs-comment
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate productivity tool designed to automate UI interactions in Google Docs using the Chrome DevTools Protocol (CDP).
- [COMMAND_EXECUTION]: The Bash wrapper (
gdocs-comment) and Node.js script (gdocs-post.mjs) use standard command execution to coordinate automation steps, resolve local dependencies (likecdp.mjs), and manage execution flow. - [DATA_EXFILTRATION]: The skill performs an identity preflight check that extracts the email address of the currently logged-in Google account from the browser's DOM. This information is displayed locally to the user via stderr to ensure the correct account is being used and is not sent to any external destination.
- [REMOTE_CODE_EXECUTION]: The skill uses CDP to execute JavaScript within the browser context to interact with the Google Docs UI. These scripts are hardcoded, static strings defined within the Node.js source code for element selection and visibility checks; no untrusted or remote code is executed.
- [EXTERNAL_DOWNLOADS]: The skill requires the
chrome-cdpskill to be present on the system but does not attempt to download it or any other external resources at runtime.
Audit Metadata