files

The skill’s capabilities match its stated Google Drive purpose, but trust and data-flow boundaries are weaker than a direct Google API integration. Main risk comes from routing authenticated Drive operations through an opaque Shift gateway and invoking an undocumented local helper for content uploads; this is suspicious/intermediate risk, not confirmed malware.