Security audit
Security checks for vulnerabilities and agentic risk
This skill is purpose-aligned for mounting Google Drive, but it handles long-lived Google credentials and installs a persistent system service in ways that need careful review.
Review this before installing or running it on any machine with sensitive Google Drive data. Prefer rclone's normal OAuth flow or a user-scoped service, avoid --allow-other unless you intend to share the mount locally, require restrictive permissions on credential files, and do not run the setup script with untrusted mount paths or without understanding that it creates boot-time system persistence.
scripts/setup-gdrive-mount.sh:55Root-Owned Systemd Unit Injection Through Unvalidated Mount Path
scripts/setup-gdrive-mount.sh:14OAuth Refresh Token Written to a Predictable Shared Temporary File
scripts/setup-gdrive-mount.sh:37Persistent Rclone Credential File Created Without Enforced Restrictive Permissions
scripts/setup-gdrive-mount.sh:63Google Drive Mount Exposed to Other Local Users by Default
Exporting the keyring password into an environment variable and writing tokens to /tmp exposes highly sensitive authentication material to local process inspection, shell history, insecure temp-file handling, or accidental disclosure. This creates a straightforward path to compromise of the user's Google account data.
gog already has a valid refresh token. Export it:
export GOG_KEYRING_PASSWORD=<your-password>
gog auth tokens export <email@gmail.com> --out /tmp/gog_token.json --overwrite
The skill instructs accessing local credential stores and extracting client credentials and refresh tokens from config files. This is dangerous because it normalizes direct secret harvesting and reuse outside the original tool's protected workflow, increasing the risk of credential theft and long-lived account compromise.
Extract the refresh_token, client_id, and client_secret from:
- `/tmp/gog_token.json` → refresh_token
- `~/.config/gogcli/credentials.json` → client_id, client_secret
## Step 2: Configure rclone
The instructions encourage manual token refresh and insertion of access tokens into rclone.conf. Handling bearer and refresh tokens manually in plaintext raises the risk of accidental leakage through terminal logs, files, backups, or shared home directories.
team_drive =
Manually refresh the access token (rclone will auto-refresh thereafter):
```bash
curl -s -X POST https://oauth2.googleapis.com/token \
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#
# Prerequisites:
# - gog CLI authenticated with the Gmail account
# - GOG_KEYRING_PASSWORD set in environment
# - rclone installed
set -euo pipefail
The script reads the OAuth client ID directly from the local gog credential file as part of assembling reusable Drive access. While a client ID alone is less sensitive than a secret, this access pattern is part of bulk credential harvesting behavior and contributes to unauthorized reuse of another tool's OAuth configuration.
# Extract values
REFRESH_TOKEN=$(python3 -c "import json; print(json.load(open('/tmp/gog_token.json'))['refresh_token'])")
CLIENT_ID=$(python3 -c "import json; print(json.load(open('$HOME/.config/gogcli/credentials.json'))['client_id'])")
CLIENT_SECRET=$(python3 -c "import json; print(json.load(open('$HOME/.config/gogcli/credentials.json'))['client_secret'])")
# Step 2: Get access token
The script reads the OAuth client secret from ~/.config/gogcli/credentials.json and then uses it to mint tokens and persist Drive access. Client secret extraction from another application's stored credentials is sensitive credential access and materially increases the blast radius if the script or host is compromised.
# Extract values
REFRESH_TOKEN=$(python3 -c "import json; print(json.load(open('/tmp/gog_token.json'))['refresh_token'])")
CLIENT_ID=$(python3 -c "import json; print(json.load(open('$HOME/.config/gogcli/credentials.json'))['client_id'])")
CLIENT_SECRET=$(python3 -c "import json; print(json.load(open('$HOME/.config/gogcli/credentials.json'))['client_secret'])")
# Step 2: Get access token
echo "==> Refreshing access token..."
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
CLIENT_ID=$(python3 -c "import json; print(json.load(open('$HOME/.config/gogcli/credentials.json'))['client_id'])")
CLIENT_SECRET=$(python3 -c "import json; print(json.load(open('$HOME/.config/gogcli/credentials.json'))['client_secret'])")
# Step 2: Get access token
echo "==> Refreshing access token..."
TOKEN_JSON=$(curl -s -X POST https://oauth2.googleapis.com/token \
-d "client_id=$CLIENT_ID" \
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
CLIENT_ID=$(python3 -c "import json; print(json.load(open('$HOME/.config/gogcli/credentials.json'))['client_id'])")
CLIENT_SECRET=$(python3 -c "import json; print(json.load(open('$HOME/.config/gogcli/credentials.json'))['client_secret'])")
# Step 2: Get access token
echo "==> Refreshing access token..."
TOKEN_JSON=$(curl -s -X POST https://oauth2.googleapis.com/token \
-d "client_id=$CLIENT_ID" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# Step 2: Get access token
echo "==> Refreshing access token..."
TOKEN_JSON=$(curl -s -X POST https://oauth2.googleapis.com/token \
-d "client_id=$CLIENT_ID" \
-d "client_secret=$CLIENT_SECRET" \
-d "refresh_token=$REFRESH_TOKEN" \
The script writes both the access token and refresh token in plaintext to ~/.config/rclone/rclone.conf, creating a durable credential store that can be reused to access the user's Drive. This is especially risky because the refresh token enables continued reauthentication and the script does not set restrictive permissions or inform the user of the persistence.
The script overwrites a systemd unit under /etc, enables it at boot, and starts it immediately without confirmation. That creates persistence and changes system behavior in a privileged location, which is dangerous in an agent skill because it can survive the session and continuously expose mounted cloud data to the local system.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
systemctl start rclone-gdrive
# Cleanup
rm -f /tmp/gog_token.json
echo "✅ Google Drive mounted at $MOUNT (auto-mount on boot enabled)"
The skill instructs use of shell commands but does not declare any tool scope or permission boundaries. In agent environments, undeclared shell capability increases the chance of unsafe execution, especially because the skill performs credential handling and system configuration changes.
These instructions direct the user to export OAuth secrets, extract refresh tokens and client secrets, and place them into files without warning about secret exposure, file permissions, shell history, or temporary-file risk. A stolen refresh token or client secret can allow persistent unauthorized access to the user's Google Drive.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
export GOG_KEYRING_PASSWORD=<your-password>
gog auth tokens export <email@gmail.com> --out /tmp/gog_token.json --overwrite
Extract the refresh_token, client_id, and client_secret from:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Manually refresh the access token (rclone will auto-refresh thereafter):
curl -s -X POST https://oauth2.googleapis.com/token \
-d client_id=<client_id> \
-d client_secret=<client_secret> \
-d refresh_token=<refresh_token> \
The skill recommends a system-wide mount and persistent boot-time service with --allow-other but does not warn that this can expose mounted Drive contents to other local users or broaden access on a multi-user system. Persistence via systemd also increases the blast radius of any credential misuse or misconfiguration.
Enabling a boot-time systemd service establishes persistent execution and ongoing access to Google Drive using stored credentials. While persistence is legitimate for an automount use case, it becomes security-relevant because it survives reboots and may continue exposing data if the host or account is later compromised.
systemctl daemon-reload
systemctl enable rclone-gdrive
systemctl start rclone-gdrive
The script reads highly sensitive OAuth material, including a refresh token and client credentials, and uses them non-interactively without warning, confirmation, or safeguards. In this context that is dangerous because refresh tokens can provide long-lived access to Google Drive data, and the script normalizes direct credential extraction from local stores and temporary files.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Step 2: Get access token
echo "==> Refreshing access token..."
TOKEN_JSON=$(curl -s -X POST https://oauth2.googleapis.com/token \
-d "client_id=$CLIENT_ID" \
-d "client_secret=$CLIENT_SECRET" \
-d "refresh_token=$REFRESH_TOKEN" \
Writing an rclone config that contains a refresh token establishes durable authenticated access that persists beyond the current session. Although not 'session persistence' in the classic malware sense, it creates ongoing credential-backed access that future processes can reuse without reauthenticating the user.
ACCESS_TOKEN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
EXPIRY=$(date -u -d "+3600 seconds" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || python3 -c "from datetime import datetime,timedelta; print((datetime.utcnow()+timedelta(hours=1)).strftime('%Y-%m-%dT%H:%M:%SZ'))")
# Step 3: Write rclone config
echo "==> Writing rclone config..."
mkdir -p ~/.config/rclone
cat > ~/.config/rclone/rclone.conf <<EOF
Enabling the service with systemctl creates persistence across reboots, causing the cloud mount to reappear automatically and extending the lifetime of access to Drive data. In an agent skill, unprompted persistence is dangerous because it changes the system beyond the immediate task and may expose sensitive files to future users or processes.
EOF
systemctl daemon-reload
systemctl enable rclone-gdrive
systemctl start rclone-gdrive
# Cleanup
No suspicious patterns detected.