google-drive

SUSPICIOUS: The core Drive capabilities match the stated purpose, and browser-based OAuth plus keyring storage are broadly plausible. However, the undocumented claim that token refresh uses 'Google's cloud function' does not align with Google's normal OAuth token flow and introduces a significant data-flow concern; combined with broad read/write Drive scope and inaccurate account restrictions, this makes the skill medium risk rather than benign.

The code is an OAuth credential-management utility with no clear evidence of malware such as command execution, persistence, or system-data theft. However, it delegates OAuth redirection and refresh-token processing to a hardcoded third-party domain, which creates a significant credential-trust and potential token-exfiltration risk. The broad Drive scope and explicit access-token printing increase exposure. The OAuth state handling and callback response also contain bugs that likely prevent successful authentication. The external service should be independently verified before use, and refresh tokens should preferably be exchanged directly with Google's official endpoint.