google-drive
Audited by Socket on Feb 17, 2026
1 alert found:
Malware[Skill Scanner] Instruction to copy/paste content into terminal detected This repository README describes a full-featured Google Drive skill whose declared capabilities (list/search/upload/download/export/mkdir/move/copy/rename/trash/delete/share/permissions) are coherent with the credentials and scopes it requests. There are no signs in this text of hidden data exfiltration, obfuscated malware, or routing credentials to third-party endpoints. Primary risks are operational: the skill requires broad Drive and cloud scopes (high privilege) and runs local setup scripts (which must be audited). Overall this description appears benign for its intended purpose but carries moderate operational risk due to powerful Drive operations and the need to trust local scripts and OAuth credentials. Recommend auditing any shipped scripts before executing and using least-privilege credentials. LLM verification: This SKILL.md describes a legitimate-seeming Google Drive management skill whose documented capabilities align with its stated purpose. I found no direct evidence of malicious code or obfuscated payloads in the provided documentation. However, the skill requires broad Drive and cloud scopes and exposes operations (make public, share, delete) that can be abused to exfiltrate or publish sensitive data. Because implementation code was not supplied, I cannot verify safe handling of credentials or ab