Gmail Checker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.3.2

Overview

This Gmail skill appears purpose-aligned, but it needs review because it handles private email and OAuth secrets with weak disclosure and unsafe credential-entry guidance.

Install only if you are comfortable granting read-only Gmail access and storing a refresh token locally. Do not paste OAuth client secrets into chat; enter them directly in a local, trusted terminal, and prefer a private SKILL_DATA_DIR or OS credential store. Revoke the Google OAuth grant if you stop using the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup_gmail.py:145

Finding

OAuth Client Secret Is Collected Through Echoed Terminal Input

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/setup_gmail.py:48

Finding

OAuth Credential File Is Permission-Hardened Only After Sensitive Data Is Written

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:31

Finding

Third-Party Runtime Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior says the skill checks unread Gmail and produces a filtered digest, but the analyzed behavior indicates it primarily performs OAuth credential collection and token storage while not actually implementing the claimed inbox-reading workflow. This mismatch is dangerous because users and orchestrators may authorize sensitive Gmail access under false expectations, enabling credential harvesting or unnecessary persistence of highly sensitive tokens.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill declares no explicit tool or permission boundaries despite requiring environment access, file writes, network access, and shell execution. In an agent ecosystem, this increases the chance the skill is invoked with broader capabilities than users expect, especially because it handles OAuth credentials and local token storage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation phrases are broad enough to match common email-related requests, which can cause the skill to activate unexpectedly in situations where the user did not intend to authorize Gmail access or expose message summaries. Because the skill touches sensitive communications data, overbroad triggering materially raises privacy and consent risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill does not clearly warn that it accesses Gmail metadata and may surface sensitive email content in its output. Without an explicit privacy warning, users may unknowingly expose personal, financial, or security-related information through the agent interface or logs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description lacks clear non-activation conditions and boundary rules, making it ambiguous when the agent should or should not invoke this Gmail-accessing capability. In a privacy-sensitive context, ambiguous routing can lead to accidental mailbox access or disclosure of email content in response to general conversation prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly tells the agent to ask the user for their OAuth Client ID and Client Secret, which encourages collection of sensitive credentials in the chat/session layer rather than directing the user to enter them locally. In an agent setting, this increases the chance that secrets are logged, retained, exposed to operators, or mishandled by downstream tooling, especially because there is no warning about sensitivity or safer handling path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code makes network calls to Gmail to retrieve unread message metadata, including sender, subject, and date, and later prints that information to stdout. While the module docstring describes functionality and required credentials, it does not explicitly warn that private inbox data will be fetched from a remote service and displayed, which meets the missing-warning criteria for code files handling potentially sensitive user data.

Content

No source excerpt is available for this finding.

Tainted flow: 'CREDS_PATH' from os.environ.get (line 29, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/setup_gmail.py (reported line 50)May include surrounding context.

python

def save_credentials(creds_data):
    os.makedirs(DATA_DIR, exist_ok=True)
    with open(CREDS_PATH, "w") as f:
        json.dump(creds_data, f, indent=2)
    os.chmod(CREDS_PATH, 0o600)
    print(f"\nCredentials saved to {CREDS_PATH}")

Static analysis

No suspicious patterns detected.