google-direct-oauth

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md and accompanying scripts (scripts/google_auth.py, scripts/oauth-server.ts, and references/api-notes.md) explicitly fetch and read user Gmail, Calendar, Drive/Docs/Sheets data (emails, events, docs) from external/untrusted users via Google APIs and the skill both interprets that content (e.g., "Read my recent emails") and has scopes to act on it (send emails, create/modify events/docs), so third‑party content could materially influence agent actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to store OAuth credentials on the host and "registers a background service" (persistent daemon) which implies modifying the machine's runtime/service configuration and running persistent processes—actions that change system state and may require elevated privileges even though it doesn't explicitly request sudo.