ClawHub
Back to skill

Security audit

Google Drive

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Google Drive helper, but it uses broad Drive credentials and has under-scoped authentication behavior that should be reviewed before installation.

Install only if you intend to give this skill broad Google Drive access. Prefer a least-privilege Google credential, avoid untrusted service-account JSON files, restrict or remove arbitrary --scope use, and require explicit confirmation before upload or folder-creation commands, especially in shared drives or delegated Workspace environments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gdrive_sa.py:97
Finding

Unvalidated Service-Account Token URI Enables SSRF and Disclosure of Signed Authentication Material

Content
View full analysis
str: now = int(time.time()) header = {"alg": "RS256", "typ": "JWT"} claim = { "iss": sa["client_email"], "scope": scope, "aud": sa.get("token_uri", "https://oauth2.googleapis.com/token"), "iat": now, "exp": now + 3600, } if subject: claim["sub"] = subject signing_input = f"{b64url(json.dumps(header, separators=(',', ':')).encode())}.{b64url(json.dumps(claim, separators=(',', ':')).encode())}" signature = sign_rs256(signing_input.encode("ascii"), sa["private_key"]) assertion = f"{signing_input}.{b64url(signature)}" payload = urllib.parse.urlencode( { "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", "assertion": assertion, } ).encode("utf-8") req = urllib.request.Request( sa.get("token_uri", "https://oauth2.googleapis.com/token"), data=payload, headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST", ) try: with urllib.request.urlopen(req) as resp: data = json.loads(resp.read().decode("utf-8")) except urllib.error.HTTPError as exc: detail = exc.read().decode("utf-8", "replace") raise SystemExit(f"Token exchange failed: HTTP {exc.code}: {detail}") return data["access_token"] ``` ### Technical Analysis The service-account JSON is loaded from `GOOGLE_SERVICE_ACCOUNT_KEY`, which may either contain JSON directly or identify a local JSON file. Its optional `token_uri` property is used without validation as: 1. The `aud` claim of a newly signed JWT assertion. 2. The destination of an outbound HTTP POST request. No check restric ...[truncated 2570 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (14)

Tainted flow: 'req' from os.environ.get (line 120, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gdrive_sa.py (reported line 66)May include surrounding context.

python
method="POST",
    )
    try:
        with urllib.request.urlopen(req) as resp:
            data = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        detail = exc.read().decode("utf-8", "replace")

Tainted flow: 'req' from os.environ.get (line 120, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gdrive_sa.py (reported line 145)May include surrounding context.

python
method="POST",
    )
    try:
        with urllib.request.urlopen(req) as resp:
            data = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        detail = exc.read().decode("utf-8", "replace")

Tainted flow: 'req' from os.environ.get (line 120, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gdrive_sa.py (reported line 158)May include surrounding context.

python
method="POST",
    )
    try:
        with urllib.request.urlopen(req) as resp:
            data = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        detail = exc.read().decode("utf-8", "replace")

Tainted flow: 'req' from os.environ.get (line 120, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The token exchange endpoint is taken from the service-account JSON via sa.get("token_uri", ...), so a malicious or untrusted GOOGLE_SERVICE_ACCOUNT_KEY value can redirect the signed JWT assertion to an attacker-controlled URL. That would disclose a bearer-style assertion signed by the private key and could leak delegated subject information, turning credential material into an exfiltration channel.

Content

Scanner excerpt · scripts/gdrive_sa.py (reported line 127)May include surrounding context.

python
method="POST",
    )
    try:
        with urllib.request.urlopen(req) as resp:
            data = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        detail = exc.read().decode("utf-8", "replace")

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
- `GOOGLE_SERVICE_ACCOUNT_KEY` for service-account auth
- `GOOGLE_OAUTH_REFRESH_TOKEN` for the dashboard Google Drive OAuth connector

OAuth mode also needs `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` so the refresh token can be exchanged for an access token.

This skill is for:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gdrive_sa.py (reported line 48)May include surrounding context.

python
- `GOOGLE_SERVICE_ACCOUNT_KEY` for service-account auth
- `GOOGLE_OAUTH_REFRESH_TOKEN` for the dashboard Google Drive OAuth connector

OAuth mode also needs `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` so the refresh token can be exchanged for an access token.

This skill is for:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill exposes significant capabilities via environment variables, shell execution, filesystem read/write, and network access, but does not declare any explicit tool scope or permissions boundary. That increases the chance an agent can invoke this skill with broader authority than intended, including access to Google Drive data and local file paths, without clear policy enforcement or user visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The private key from GOOGLE_SERVICE_ACCOUNT_KEY is written to a temporary file on disk so openssl can use it. Even with 0600 permissions and cleanup, writing secret key material to disk increases exposure to forensic recovery, backup capture, crash artifacts, or local compromise.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gdrive_sa.py (reported line 80)May include surrounding context.

python
try:
        os.write(fd, private_key.encode("utf-8"))
        os.close(fd)
        proc = subprocess.run(
            ["openssl", "dgst", "-sha256", "-sign", key_path],
            input=message,
            stdout=subprocess.PIPE,

Tainted flow: 'data' from pathlib.Path.read_bytes (line 307, file read) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/gdrive_sa.py (reported line 183)May include surrounding context.

python
path = Path(out_path)
        path.parent.mkdir(parents=True, exist_ok=True)
        if text:
            path.write_text(data.decode("utf-8"))
        else:
            path.write_bytes(data)
        print(str(path))

Tainted flow: 'data' from pathlib.Path.read_bytes (line 307, file read) → pathlib.Path.write_bytes (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/gdrive_sa.py (reported line 185)May include surrounding context.

python
if text:
            path.write_text(data.decode("utf-8"))
        else:
            path.write_bytes(data)
        print(str(path))
        return
    if text:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description frames the capability as Drive access, but the code also supports creating folders and uploading content. In agent settings, capability understatement is dangerous because operators may grant credentials expecting read-oriented access while the skill can also modify remote data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The --scope argument allows arbitrary OAuth scopes rather than constraining the tool to the stated Drive purpose. In an agent context, this enables privilege expansion if a caller supplies broader scopes and the backing credentials permit them.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The --subject option enables domain-wide delegation impersonation of arbitrary users when used with a suitably configured service account, yet this capability is not disclosed in the skill purpose. In enterprise environments this greatly increases risk because the skill can act as other principals and access or modify their Drive data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.