google-docs-automation
Warn
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill documentation states that OAuth access tokens are refreshed using a "cloud function." Standard Google OAuth implementations typically refresh tokens locally by directly calling official Google API endpoints. Using an intermediary cloud function for token refresh is a non-standard practice that introduces a potential vector for credential interception or exfiltration by an external service.
- [INDIRECT_PROMPT_INJECTION]: The skill provides the ability to read content from external Google Documents, which may contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Document text is ingested into the agent context via the
scripts/docs.py get-textcommand. - Boundary markers: The instructions do not include boundary markers or warnings to the agent to disregard instructions found within the document content.
- Capability inventory: The skill allows for document creation, searching, content modification (append/insert/replace), and execution of local Python scripts.
- Sanitization: There is no mention of sanitizing or filtering document content prior to its ingestion.
- [COMMAND_EXECUTION]: The skill relies on executing local Python scripts (
scripts/auth.pyandscripts/docs.py) to perform authentication and document operations.
Audit Metadata