Skills/npm/google-drive-mcp

google-drive-mcp@2.13.0

CAUTION

Publisher claims: "Secure access to Google Drive, Docs, Sheets, Slides, and Calendar through MCP." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher piotr-agier · joined 0 days agoInstalls 29,076Last detonated 1 h ago
Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
npx invocation of non-well-known packagedocs/setup.md:90 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedocs/clients.md:16 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Outbound HTTP to raw IP addressdocs/authentication.md:51 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
npx invocation of non-well-known packageREADME.md:50 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedocs/authentication.md:271 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Outbound HTTP to raw IP addressdocs/clients.md:85 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
npx invocation of non-well-known packagedocs/deployment.md:11 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Process kill commanddocs/troubleshooting.md:32 · Process kill command — agent can terminate processes
AST05
HIGH
npx invocation of non-well-known packagedocs/setup.md:87 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedocs/setup.md:81 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Prompting user to enter sensitive credentialsdocs/deployment.md:155 · Prompting user to enter sensitive credentials — social engineering
AST03
HIGH
npx invocation of non-well-known packagedocs/clients.md:76 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
URL using raw IP addressdocs/troubleshooting.md:24 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressdocs/clients.md:85 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
npx invocation of non-well-known packagedocs/troubleshooting.md:171 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedocs/troubleshooting.md:125 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Outbound HTTP to raw IP addressdocs/troubleshooting.md:24 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addressdocs/authentication.md:51 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
npx invocation of non-well-known packagedocs/troubleshooting.md:50 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedocs/troubleshooting.md:38 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedocs/troubleshooting.md:170 · npx invocation of non-well-known package — may execute untrusted code
AST06