ClawHub
Back to skill

Security audit

Skill to manage and update google sheet

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Google Sheets automation skill, but users should protect the service-account key and be careful with commands that modify or delete spreadsheet data.

Install only if you are comfortable giving a service account read/write access to the spreadsheets you share with it. Store the JSON key outside the skill directory when possible, keep it out of source control, restrict permissions, rotate or revoke it if exposed, and review commands like clear and deleteSheet before running them on important sheets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Credential Access

High
Category
Privilege Escalation
Content
2. **Configure credentials** (one of these):
   - Set env: `GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/key.json`
   - Place `service-account.json` or `credentials.json` in the skill directory
   - Place in `~/.config/google-sheets/credentials.json`

3. **Share sheets** with the service account email (found in JSON key as `client_email`)
Confidence
90% confidence
Finding
The skill instructs users to store credential files in the skill directory, which is a sensitive location because local credentials may be unintentionally exposed to other tooling, backups, or repository operations. Since these are service-account keys, compromise could grant unauthorized access to spreadsheets shared with that account.

Credential Access

High
Category
Privilege Escalation
Content
2. **Configure credentials** (one of these):
   - Set env: `GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/key.json`
   - Place `service-account.json` or `credentials.json` in the skill directory
   - Place in `~/.config/google-sheets/credentials.json`

3. **Share sheets** with the service account email (found in JSON key as `client_email`)
Confidence
86% confidence
Finding
Storing credentials under a predictable path in the user's home directory can create persistent credential exposure if filesystem permissions are weak, the machine is shared, or other processes can read the file. The issue is amplified because service-account keys are reusable secrets with ongoing API access.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: Alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# The script also checks these locations automatically:
# - ./service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: Alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# The script also checks these locations automatically:
# - ./service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: Alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# The script also checks these locations automatically:
# - ./service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: Alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# The script also checks these locations automatically:
# - ./service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: Alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# The script also checks these locations automatically:
# - ./service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
GOOGLE_SERVICE_ACCOUNT_KEY=/path/to/service-account.json

# Option 2: Alternative env var name
# GOOGLE_SHEETS_KEY_FILE=/path/to/credentials.json

# The script also checks these locations automatically:
# - ./service-account.json
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Possible Typosquatting: 'gaxios' resembles popular package 'axios'

High
Category
Supply Chain
Confidence
70% confidence
Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Missing User Warnings

High
Confidence
98% confidence
Finding
The deleteSheet function removes an entire sheet via batchUpdate, which is a destructive operation affecting user data. The code performs the deletion immediately without any confirmation prompt or explicit warning in nearby CLI help text that the action is destructive.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill clearly relies on sensitive capabilities—environment access for credentials and network access to Google APIs—yet the manifest does not declare any tool scope or permission boundaries. This increases the chance an agent can invoke the skill with broader-than-expected access and reduces reviewability of what the skill is allowed to do.

Session Persistence

Medium
Category
Rogue Agent
Content
1. **Google Cloud Console:**
   - Create/select a project
   - Enable "Google Sheets API"
   - Create a Service Account (IAM → Service Accounts → Create)
   - Download JSON key

2. **Configure credentials** (one of these):
Confidence
82% confidence
Finding
The setup process relies on downloading and persistently storing a JSON service-account key, which creates long-lived session or credential persistence on disk. Persistent credentials increase the blast radius of host compromise and can enable continued unauthorized access long after initial use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The credential setup instructions tell users to place a service-account key in common file locations but do not include any warning that the JSON key is highly sensitive and grants API access. This can normalize insecure handling of long-lived credentials and increase the risk of accidental exposure through source control, logs, or shared directories.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documented commands include destructive operations like write, append, and clear without warning that they modify remote spreadsheet data and may overwrite or erase content. In an agent setting, lack of explicit caution can lead to accidental data loss or unintended modification of production spreadsheets.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Sheet management commands such as deleteSheet and renameSheet can remove or alter spreadsheet structure, but the documentation does not warn users about destructive consequences. This is risky because an agent may execute these commands against important spreadsheets without adequate human confirmation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The clearRange function deletes spreadsheet cell contents through the Google Sheets API, but there is no confirmation prompt, warning message, or other user-facing disclosure before this irreversible data-modifying action occurs. Although the CLI usage lists the command, it does not warn that invoking it will erase existing cell data.

Known Vulnerable Dependency: qs==6.14.1 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-2391 (qs's arrayLimit bypass in comma parsing allows denial of service)

Low
Category
Supply Chain
Confidence
91% confidence
Finding
The lockfile includes qs 6.14.1, and the reported advisories are plausible denial-of-service issues in querystring parsing/stringifying edge cases. In this skill, qs is only a transitive dependency of googleapis-common, so exploitation would depend on attacker-controlled input reaching vulnerable qs code paths, which makes the practical risk lower but still real.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low
Category
Supply Chain
Confidence
83% confidence
Finding
The lockfile includes uuid 9.0.1 with an advisory for missing buffer bounds checks in certain version-generation functions when a caller provides a buffer. This is a genuine supply-chain risk, but in this skill it is a transitive dependency used by Google client libraries, and there is no evidence in this file that the risky API usage is directly exposed, so impact remains limited.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"sheets": "node scripts/sheets.js"
  },
  "dependencies": {
    "googleapis": "^140.0.0"
  }
}
Confidence
89% confidence
Finding
The dependency uses a caret range (^140.0.0), which allows automatic installation of newer minor and patch releases. This can introduce supply-chain risk because builds are not fully reproducible and a compromised or breaking upstream release could be pulled in without review. In this skill, the package interacts with Google Sheets using service-account credentials, so dependency compromise could expose sensitive spreadsheet data or credentials, though the direct severity from version range usage alone remains low.

Static analysis

No suspicious patterns detected.