google-docs-automation
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
scripts/auth.pyandscripts/docs.py) to manage authentication and document operations. - [DATA_EXFILTRATION]: The skill documentation states that access tokens are refreshed using a remote cloud function. Transmitting OAuth credentials to an unspecified external service poses a risk of credential harvesting or unauthorized access if the service is compromised or malicious.
- [PROMPT_INJECTION]: The skill processes untrusted document content, which facilitates indirect prompt injection attacks.
- Ingestion points: Document text is retrieved into the agent context via the
get-textcommand. - Boundary markers: No delimiters or instructions are used to distinguish document content from system instructions.
- Capability inventory: The agent can execute commands, modify document content, and create new documents, providing a significant impact path for malicious instructions.
- Sanitization: There is no evidence of filtering or validation logic for the ingested text.
Audit Metadata