google-slides

SUSPICIOUS. The core capability mostly matches a Google Slides integration, and data appears intended for official Google services, but the skill under-discloses its actual access footprint: 'find' likely requires Drive API access, scopes are unspecified, and the token refresh description is inconsistent with standard Google OAuth docs. This is better classified as a moderately risky, under-specified integration than confirmed malware.

The code is an OAuth helper with plausible intended functionality and no clear evidence of malware or sabotage. Its primary security concern is architectural: refresh tokens are sent to the hardcoded third-party cloud service, creating a credential trust and supply-chain risk. It also exposes access tokens on request, requests broad Google scopes, and has an unescaped error-to-HTML path. As supplied, the file cannot run because of the incomplete `main(` call. The code should not be treated as safe without reviewing and trusting the cloud service implementation and correcting the OAuth/error-handling issues.