google-drive-upload

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill reads a local config file, extracts an Apps Script URL from it, and requires embedding that URL verbatim into generated curl commands/outputs, which exposes a secret/endpoint value in the agent's context and output.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). drive.google.com is an official file-hosting service that is commonly abused to distribute binaries and installers, and msapps.mobi is an unknown/non-official domain (not microsoft.com) that appears to host plugin/endpoints—together they enable third-party upload/hosting of arbitrary files and therefore represent a suspicious distribution vector.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill is high-risk: it is explicitly designed to read arbitrary local files and send their base64-encoded contents to an externally-configurable web endpoint (Apps Script URL) — with instructions to avoid logging the raw config, remove temporary payloads, and offer "unlimited" uploads — which is behavior consistent with deliberate data exfiltration to an untrusted server if the configured endpoint is attacker-controlled.