google-sheets

Pass

Audited by Gen Agent Trust Hub on Apr 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: In SKILL.md, the skill uses curl and jq for API communication and data processing, and writes temporary request bodies to /tmp/gsheets_request.json. It also references the vendor's zero CLI tool.
  • [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes data from external spreadsheets. Ingestion points: Data is read from the Google Sheets API in SKILL.md. Boundary markers: None identified. Capability inventory: The skill has network access and file system write capabilities. Sanitization: No sanitization of ingested spreadsheet data is performed.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 17, 2026, 11:13 AM