Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Google Sheets automation CLI, but users should scope credentials carefully because it can modify and delete spreadsheet data.
Install only with a tightly scoped service account shared to the specific spreadsheets needed. Prefer read-only credentials for read workflows, test write and batch commands on non-production spreadsheets first, and be careful with clear, deleteSheet, and raw batch because they can remove or alter data without an additional prompt.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json
# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json
# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json
# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json
# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json
# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json
# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json
# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json
# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json
# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json
# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json
# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json
# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json
# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json
# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json
# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json
# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
The deleteSheet command permanently removes a worksheet by issuing a deleteSheet batch update, yet there is no confirmation prompt, safety interlock, or visible warning to the user in this file. Deleting an entire sheet is a destructive action that can materially affect user data and should not occur silently.
The skill documents use of environment variables and outbound access to Google Sheets, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the risk that the skill can access secrets from the environment and perform networked actions without clear operator review or least-privilege controls.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Best fit
- You need a repeatable CLI for automation tasks.
- You want JSON-in/JSON-out for pipelines.
- You need more than basic read/write (formatting, sheet ops, batch updates).
## Not a fit
- You must use end-user OAuth consent flows (this skill is service-account focused).
The documentation exposes destructive capabilities such as write, clear, deleteSheet, renameSheet, and raw batch updates without prominently warning that these actions can alter or irreversibly destroy spreadsheet data. In an automation context, this can lead to accidental mass modification or deletion when an agent invokes powerful commands without adequate safeguards.
The guide documents write, append, batchUpdate, and structural operations including deleteSheet without any explicit warning that these actions can permanently modify or remove spreadsheet data. In an agent skill context, this omission increases the chance that an autonomous or inattentive user will run destructive commands against production spreadsheets without safeguards, confirmation, or backup awareness.
The clear command deletes cell contents in the specified range via the Sheets API, but the code provides no confirmation prompt, warning message, or other user-facing disclosure before performing the operation. Clearing spreadsheet data is potentially irreversible for the user and should be explicitly disclosed at execution time or in surrounding documentation.
The dependency is specified with a caret range (^140.0.0), which allows future 140.x releases to be installed without explicit review. This weakens build reproducibility and can silently introduce vulnerable or behavior-changing upstream versions into a skill that interacts with external APIs and likely handles credentials.
"help": "node scripts/sheets-cli.js help"
},
"dependencies": {
"googleapis": "^140.0.0"
}
}
The manifest references googleapis without an exact pinned version, while the package family has a known advisory for improper authorization. Because the installed version is not fixed and cannot be verified from this file alone, deployments may resolve to an affected release, creating uncertainty around authorization safety in a skill designed to read and write Google Sheets data.
No suspicious patterns detected.