google-workspace
4 findings (2 high, 2 medium), mainly command injection, data exfiltration. Most recent scan 2026-02-06.
This Google Workspace skill presents HIGH security risks primarily due to insecure credential management practices. The skill requests extremely broad OAuth scopes across all Google Workspace services and stores credentials in plaintext files (credentials.json, token.pickle) in the working directory with no encryption or access controls. This creates a high-value target for credential theft. Additional concerns include arbitrary code execution risks via python3 -c patterns with user-controlled placeholders, missing security metadata (allowed-tools, license, compatibility), and unpinned dependencies. While the skill's core functionality (Google Workspace integration) is legitimate, the implementation lacks fundamental security controls for handling sensitive credentials and user data. The skill requires significant security hardening before safe deployment.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Interact with Google Workspace services - Gmail, Calendar, Contacts, Sheets, and Docs. Send emails, manage calendar events, read/write spreadsheets, create documents, and sync contacts.
- Package
- 1 file, 13 KB
- SKILL.md
- 1271 words, 12+ sections
- Code
- None. Instructions only.
- Requires
- bins:
python3
SKILL.md covers: Google Workspace CLI · Setup · 1. Install dependencies · 2. Create Google Cloud Project · 3. Authentication helper · Gmail · List recent emails · Read email by ID · Send email · Search emails · Search queries: from:, to:, subject:, after:, before:, has:attachment, is:unread · List labels
Findings
HIGH Hardcoded Broad OAuth Scopes with Persistent Token Storage Data Exfiltrationllm
The skill requests extremely broad OAuth scopes including full Gmail access (modify), Calendar, Contacts, Spreadsheets, Documents, and Drive access. These credentials are stored in a local 'token.pickle' file with no encryption or access controls. This creates a high-value target for credential theft - any malicious process or skill could read token.pickle and gain full access to the user's Google Workspace data.
SKILL.md
SCOPES = ['https://www.googleapis.com/auth/gmail.modify', 'https://www.googleapis.com/auth/calendar', 'https://www.googleapis.com/auth/contacts', 'https://www.googleapis.com/auth/spreadsheets', 'https://www.googleapis.com/auth/documents', 'https://www.googleapis.com/auth/drive']
with open('token.pickle', 'wb') as token:
pickle.dump(creds, token)HIGH Unencrypted Credential File Storage in Working Directory Data Exfiltrationllm
OAuth credentials (credentials.json) and access tokens (token.pickle) are stored as plaintext files in the working directory with no access controls, encryption, or secure storage mechanisms. Any process or user with file system access can steal these credentials and impersonate the user across all Google Workspace services.
SKILL.md
Download `credentials.json` to your working directory
if os.path.exists('token.pickle'):
with open('token.pickle', 'rb') as token:
creds = pickle.load(token)MEDIUM CODE EXECUTION detected by YARA Command Injectionstatic
Detects dangerous code execution patterns in agent skills (Python/Bash): pickle.load(
SKILL.md:39
creds = pickle.load(token)MEDIUM Arbitrary Code Execution via Python -c with User-Controlled Input Command Injectionllm
The skill instructs users to execute Python code via 'python3 -c' with placeholders like MESSAGE_ID that could be replaced with malicious input. If an agent or user substitutes these placeholders with untrusted data, it could lead to command injection. The pattern of embedding code in shell commands creates injection risk.
SKILL.md
python3 -c "
from google_auth import get_service
import base64
gmail = get_service('gmail', 'v1')
msg = gmail.users().messages().get(userId='me', id='MESSAGE_ID', format='full').execute()What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 13 KB |
External hosts referenced
www.googleapis.com console.cloud.google.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/google-workspace
- Raw scan result: google-workspace-scan.json
- Badge for your README:
- Request a re-scan