Security risk report for @forgecat/googleworkspace_cli-skills v0.1.3
Source Integrity
Low
Profile is published under @forgecat namespace, a known registry for AI agent skills.
All skills wrap the official Google Workspace APIs (Calendar v3, Gmail v1, Drive v3, Classroom v1, etc.) via the gws CLI tool.
No suspicious external dependencies, typosquatted packages, or attacker-controlled repositories referenced.
Agent Intent
Low
Content is purely descriptive documentation of legitimate Google Workspace API wrappers; no instructions to manipulate the AI, ignore system prompts, or exfiltrate data.
Skills are presented as reference material with usage examples and flags—standard API documentation patterns, not malicious guidance.
No prompt injection, role hijacking, credential harvesting, or system prompt leakage attempts detected.
Details
Evidence
README lists skills with neutral descriptions: 'Google Calendar: Manage calendars and events', 'Gmail: Send, read, and manage email'.
SKILL.md files contain standard API resource/method documentation (e.g., 'gws calendar <resource> <method> [flags]').
Caution notices on write commands (e.g., gws-calendar-insert, gws-chat-send) explicitly request user confirmation before execution.
Permissions
PRM-000Medium
Skills grant broad access to Google Workspace APIs (Drive, Gmail, Calendar, Classroom, Chat, Docs, Sheets, etc.) via the gws CLI binary, which requires OAuth2 authentication.
Authority is appropriate to stated function (e.g., gws-gmail-send sends email, gws-drive-upload uploads files), but the aggregate scope across 50+ skills covers sensitive operations: email forwarding, file deletion, calendar manipulation, classroom management.
No alwaysApply=true or globs='**' rules detected; permissions are user-initiated via explicit skill invocation.
Details
Evidence
gws-gmail-forward can forward messages to arbitrary recipients; gws-drive-upload can write to Drive; gws-calendar-insert can create events.
gws-admin-reports accesses audit logs and usage reports (requires admin privileges).
gws-classroom can create/delete courses and manage rosters.
All skills require the gws binary and OAuth2 credentials; no shell execution or file system access beyond the gws CLI interface.
MCP Risk
Low
No MCP servers are declared in the profile; all skills are CLI wrappers around the gws binary.
The gws binary is a known, legitimate Google Workspace CLI tool (version 0.22.5 referenced); no arbitrary code execution or hidden instructions in tool descriptions.
Skills delegate to official Google APIs (googleapis.com) via OAuth2; no unrestricted network access or full filesystem permissions.
Details
Evidence
Profile metadata specifies 'requires: bins: [gws]' — a single, scoped dependency.
All API calls are routed through Google's official endpoints (calendar v3, gmail v1, drive v3, etc.).
No tool descriptions contain malicious instructions or obfuscated payloads.
ForgeCat