ClawHub
Back to skill

Security audit

Google Sheets API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Google Sheets automation CLI, but users should scope credentials carefully because it can modify and delete spreadsheet data.

Install only with a tightly scoped service account shared to the specific spreadsheets needed. Prefer read-only credentials for read workflows, test write and batch commands on non-production spreadsheets first, and be careful with clear, deleteSheet, and raw batch because they can remove or alter data without an additional prompt.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# Option 3: standard Google env var
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High
Confidence
97% confidence
Finding
The `deleteSheet` command permanently removes a worksheet by issuing a `deleteSheet` batch update, yet there is no confirmation prompt, safety interlock, or visible warning to the user in this file. Deleting an entire sheet is a destructive action that can materially affect user data and should not occur silently.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documents use of environment variables and outbound access to Google Sheets, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the risk that the skill can access secrets from the environment and perform networked actions without clear operator review or least-privilege controls.

Session Persistence

Medium
Category
Rogue Agent
Content
## Best fit
- You need a repeatable CLI for automation tasks.
- You want JSON-in/JSON-out for pipelines.
- You need more than basic read/write (formatting, sheet ops, batch updates).

## Not a fit
- You must use end-user OAuth consent flows (this skill is service-account focused).
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation exposes destructive capabilities such as write, clear, deleteSheet, renameSheet, and raw batch updates without prominently warning that these actions can alter or irreversibly destroy spreadsheet data. In an automation context, this can lead to accidental mass modification or deletion when an agent invokes powerful commands without adequate safeguards.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The guide documents write, append, batchUpdate, and structural operations including deleteSheet without any explicit warning that these actions can permanently modify or remove spreadsheet data. In an agent skill context, this omission increases the chance that an autonomous or inattentive user will run destructive commands against production spreadsheets without safeguards, confirmation, or backup awareness.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The `clear` command deletes cell contents in the specified range via the Sheets API, but the code provides no confirmation prompt, warning message, or other user-facing disclosure before performing the operation. Clearing spreadsheet data is potentially irreversible for the user and should be explicitly disclosed at execution time or in surrounding documentation.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"help": "node scripts/sheets-cli.js help"
  },
  "dependencies": {
    "googleapis": "^140.0.0"
  }
}
Confidence
93% confidence
Finding
The dependency is specified with a caret range (^140.0.0), which allows future 140.x releases to be installed without explicit review. This weakens build reproducibility and can silently introduce vulnerable or behavior-changing upstream versions into a skill that interacts with external APIs and likely handles credentials.

Unverifiable Dependency: googleapis has 1 known advisory(ies) (GHSA-7543-mr7h-6v86 (Improper Authorization in googleapis)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
81% confidence
Finding
The manifest references googleapis without an exact pinned version, while the package family has a known advisory for improper authorization. Because the installed version is not fixed and cannot be verified from this file alone, deployments may resolve to an affected release, creating uncertainty around authorization safety in a skill designed to read and write Google Sheets data.

Static analysis

No suspicious patterns detected.