google-docs-automation
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to execute local Python scripts (
scripts/auth.pyandscripts/docs.py) for managing OAuth sessions and performing document operations such as searching, reading, and editing. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it allows the agent to ingest raw text content from external Google Documents into its context.
- Ingestion points: Document text retrieved via
scripts/docs.py get-textin SKILL.md. - Boundary markers: None; there are no instructions to the agent to treat document content as untrusted data or to ignore embedded instructions.
- Capability inventory: The skill provides comprehensive document manipulation capabilities, including creation, finding, reading, appending, inserting, and replacing text.
- Sanitization: The instructions do not define any sanitization or validation processes for the ingested document content.
- [EXTERNAL_DOWNLOADS]: The skill references an external "cloud function" for automated OAuth token refreshing. While the text attributes this to Google, the lack of a specific URL or verifiable identity for this endpoint creates a dependency on an external service for handling sensitive authentication tokens.
Audit Metadata