google-sheets
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill reads data from external Google Sheets via tools like listRows, findRows, lookupRow, and getValues. If a spreadsheet contains malicious instructions, an agent processing that data as part of its reasoning loop might be influenced to deviate from its intended behavior.
- Ingestion points: listRows.ts, findRows.ts, lookupRow.ts, getValues.ts.
- Boundary markers: Absent. The skill does not explicitly instruct the agent to treat the fetched row data as untrusted or wrap it in specific delimiters.
- Capability inventory: The connector can perform network operations (fetch to Google APIs), write to the file system (indirectly via the Sheets API), and execute internal scripts through the cli.js entry point.
- Sanitization: Input parameters are validated via Zod schemas, but the textual content retrieved from spreadsheets is returned to the agent without sanitization.
- [COMMAND_EXECUTION]: Internal Subprocess Invocation. The cli.js entry point uses node:child_process's spawnSync to execute the connector's compiled code or TypeScript source. This is part of the package's standard orchestration logic for local execution and is used to launch the connector's own tools.
- [EXTERNAL_DOWNLOADS]: The skill interacts with well-known Google API domains (sheets.googleapis.com and googleapis.com) to perform spreadsheet operations. These are well-known service endpoints and are consistent with the skill's primary purpose.
Audit Metadata