google-drive
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates reading and processing external data from Google Drive, creating a surface for indirect instructions to be processed by an agent.
- Ingestion points: File listing and retrieval methods (e.g.,
fileStorage.files.list,files.get) as described inSKILL.md. - Boundary markers: No explicit delimiters or boundary instructions are provided to help the agent distinguish between file content and its own system instructions.
- Capability inventory: The skill grants the agent the ability to read, search, and export files from an external, potentially attacker-controlled environment.
- Sanitization: No sanitization or content filtering steps are defined for the agent when processing retrieved file data.
- [EXTERNAL_DOWNLOADS]: The skill references and fetches the OpenAPI specification and connector documentation from Apideck's official and well-known domains (
specs.apideck.com,developers.apideck.com). - [SAFE]: The skill follows security best practices by recommending the use of environment variables for API key management and uses standard OAuth 2.0 flows for authentication as documented in the metadata and code examples.
Audit Metadata