odyssey4me/google-docs
Create and modify Google Docs documents. Read content, insert tables, apply heading styles, and manage formatting. Use when asked to edit a gdoc, write a Google document, update a doc, or format document content.
71
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The prompt includes examples that place OAuth client_id/client_secret directly in a config file and as CLI flags (auth setup --client-secret ...), which encourages the agent to accept and emit secret values verbatim into files/commands, creating an exfiltration risk.
Where we found it
[REDACTED]
secret · 4 sites
Documentation shows placeholder OAuth client_id in config file example and error message, which an agent could substitute with a real secret and emit to visible output
SKILL.md
49
client_id: [REDACTED]
50
client_secret: [REDACTED]
scripts/google-docs.py
1226
print(" client_id: YOUR_CLIENT_ID.apps.googleusercontent.com")
1227
print(" client_secret: YOUR_CLIENT_SECRET")
--client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET
command · 5 sites
The auth setup command accepts client_id and client_secret as CLI flags, which places secrets on the visible command line and saves them to a config file
SKILL.md
81
--client-id YOUR_CLIENT_ID \
82
--client-secret YOUR_CLIENT_SECRET
scripts/google-docs.py
1238
if not args.client_id or not args.client_secret:
1244
"client_id": args.client_id,
1245
"client_secret": args.client_secret,
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
This skill directly reads and parses Google Docs content via the Documents API (see SKILL.md "documents read" and scripts/google-docs.py functions like read_document_content, export_document_as_markdown, get_document, and insert_after_anchor), which can be arbitrary user-generated/untrusted third-party content and could influence subsequent tool use or actions.
Where we found it
www.googleapis.com
domain · 16 sites
The plugin directly fetches Google Docs content via the Google Docs API (docs.googleapis.com) and Drive API (drive.googleapis.com), reading arbitrary user-generated document content that could influence subsequent tool use
accounts.google.com
domain · 3 sites
The plugin uses Google OAuth flow via accounts.google.com for authentication, which is a runtime fetch of third-party content
scripts/google-docs.py
181
"auth_uri": "https://accounts.google.com/o/oauth2/auth"
scripts/google-docs.py
259
flow = InstalledAppFlow.from_client_config(client_config, scopes)
scripts/google-docs.py
260
creds = flow.run_local_server(port=0) # Opens browser for consent
oauth2.googleapis.com
domain · 2 sites
The plugin exchanges OAuth tokens via oauth2.googleapis.com during authentication and token refresh
scripts/google-docs.py
182
"token_uri": "https://oauth2.googleapis.com/token"
scripts/google-docs.py
309
creds.refresh(Request())
- Audited
- Security analysis