ClawHub
Back to skill

Security audit

ai-gmail-inbox-classifier-auto-archive-with-hourly-telegram

Security checks for vulnerabilities and agentic risk

Overview

The workflow is upfront about reading and archiving Gmail messages, but it handles sensitive email through mutable, unpinned external installs.

Review this before installing if you are comfortable granting an automation access to read Gmail messages, search sent mail, apply labels, archive every processed inbox message, and send Important-message alerts through Telegram. Prefer pinned or verified dependency installation and confirm the Gmail/Telegram scopes and workflow settings before connecting real accounts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Third-Party Skill Installation and Mutable Workflow Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24-40
Vulnerability Type: Unpinned and remotely mutable third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet

markdown
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

Equivalent unpinned installation instructions for the Gmail and Telegram integrations also appear at `SKILL.md:51-54`, `SKILL.md:62-65`, `SKILL.md:106-109`, and `SKILL.md:120-127`.

### Technical Analysis

The skill directs users to invoke an unpinned `npx` package and install skills from mutable remote sources. It does not specify an immutable package version, repository commit, cryptographic checksum, signature, or reviewed dependency manifest.

The local project does not include the implementations or schemas of the Gmail and Telegram skills. Instead, it relies on externally configured workflow-node defaults and linked remote skills. Therefore, the effective behavior that handles email content and mailbox mutations can change after this project has been audited.

This is a supply-chain weakness rather than evidence that the currently referenced dependencies are malicious. A future compromise or unauthorized 
...[truncated 1756 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npx package to an explicitly reviewed version rather than resolving the latest available release.
  2. Pin every installed skill to an immutable release identifier or repository commit hash.
  3. Publish cryptographic checksums or signed manifests and verify them before installation.
  4. Vendor the exact Gmail and Telegram tool schemas and security-relevant instructions used by the workflow so they can be audited with the parent skill.
  5. Require explicit review and approval before dependency updates or freshness-driven reinstalls.
  6. Use a lockfile or equivalent dependency manifest that records all resolved versions and integrity hashes.
  7. Restrict Gmail and Telegram permissions to the minimum scopes required by the workflow.
  8. Add a dry-run mode and require user approval before applying labels or archiving messages, particularly after dependency updates.
  9. Monitor dependency publishers, releases, and integrity-verification failures, and revoke connected account tokens promptly if compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (15)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description promotes inbox cleanup but does not clearly warn that every processed inbox email will be automatically archived and that important-email details are sent to Telegram. This creates a consent and data-handling risk: users may enable the workflow without understanding that messages are removed from the inbox and metadata/content may be disclosed to a third-party messaging channel.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill instructs users to install dependencies via npx skills ... without pinning an exact package version. That allows whatever version is current in the registry at execution time to be fetched and run, creating a supply-chain risk if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This line references npx skills without a pinned version, which means the executed package can drift over time. In a tool-installation context, that exposes users to registry compromise, typo-squatting, or a later malicious update affecting skill installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The installation script uses npx skills without version pinning, so users may execute different code depending on when they run it. Because npx can download and run packages directly, this is a meaningful software supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This second install command in the script is likewise unpinned and inherits the same risk of fetching an unexpected or compromised package version. Repetition across the document increases the chance users will copy and run vulnerable commands.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The linked tool install command uses an unpinned npx skills package reference. Since this skill depends on external tooling to operate, unpinned installation instructions broaden the attack surface for supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This unpinned npx skills invocation can resolve to a different package version in the future, including a malicious one. Because the skill is designed for automated workflow setup, users may run such commands with little scrutiny, increasing practical risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The install instruction at this line is another case of directly executing an unversioned package via npx. In documentation for automation skills, that can lead to non-reproducible installs and exposure to malicious package updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This command again relies on an unpinned npx skills package, which is unsafe for reproducibility and trust. If the upstream package is compromised, users following the skill instructions could run attacker-controlled code during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The telegram tool install command is also unpinned, preserving the same supply-chain execution risk. Since the workflow touches sensitive email and notification channels, trust in the installation path matters more, not less.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This reference to npx skills without a version allows silent drift to newer or malicious releases. Even though it appears in a reference section, users commonly copy commands from such sections directly, so the risk is real.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The AgentPMT reference section includes another unpinned npx skills install example. Multiple occurrences of the same unsafe pattern reinforce insecure setup practices and increase the chance of exploitation through package substitution or compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This adjacent command repeats the same unpinned package execution issue. Because users may run both commands together during setup, a compromised package could impact the full workflow dependency chain.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The repeated unpinned install command in the AgentPMT reference keeps the supply-chain exposure present throughout the file. In a skill whose purpose is automation over sensitive email data, insecure installation guidance is particularly concerning.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This final unpinned npx skills occurrence presents the same risk of executing an unexpected package version from the registry. The cumulative pattern across the skill suggests poor supply-chain hygiene rather than an isolated typo.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.