ClawHub
Back to skill

Security audit

Google Chat

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Google Chat connector, but it gives an agent power to edit/delete messages and move files without enough up-front disclosure or confirmation guidance.

Review this before installing if the connected Google account has important business chats. Use it only with clear user-directed requests, confirm the exact destination before sending files or replies, and require explicit confirmation before editing or deleting messages, especially with force=true. Prefer OpenClaw or pinned/reviewed setup instructions over unpinned npx commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:591
Finding

Unpinned Third-Party Installation Commands Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 591-592
Vulnerability Type: Unpinned third-party package and remote Skill installation
Risk Level: Medium

Vulnerable Code

bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup

Equivalent unpinned installation instructions also appear at SKILL.md:481, SKILL.md:585, and SKILL.md:642-643.

Technical Analysis

The documented setup process invokes the skills npm package through npx without specifying an immutable package version. It then installs Skill content from AgentPMT/agent-skills without pinning that source to a reviewed commit, release, or cryptographic digest.

Consequently, the artifacts resolved when a user runs these commands may differ from those available during this audit. The effective installation payload remains under the control of external package and repository publishers. Compromise of the npm package, source repository, publisher credentials, release process, or dependency chain could cause users to retrieve unreviewed content.

The audited project itself contains only documentation and schemas; no embedded malicious script was identified. The risk arises when users follow the external installation commands.

Attack Path

  1. An attacker compromises the npm package, the AgentPMT/agent-skills repository, a publisher account, or an upstream release dependency.
  2. The attacker publishes a modified latest package or changes the remotely resolved Skill content.
  3. A user follows the unpinned npx skills add ... instructions from SKILL.md.
  4. npx resolves the package available at execution time, and the installer retrieves the mutable remote Skill content.
  5. The altered installer or Skill executes or introduces attacker-controlled behavior under the permissions available to the invoking user or agent environment.

Impact Assessment

Successful ...[truncated 537 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm package to an explicitly reviewed version rather than relying on dynamic resolution, for example:
    bash
    npx skills@<reviewed-version> add ...
  2. Pin AgentPMT/agent-skills to an immutable commit hash or signed release instead of a mutable repository state.
  3. Publish and verify cryptographic checksums or signatures for downloaded packages and Skill artifacts.
  4. Configure npm to use a trusted registry and require lockfile integrity where applicable.
  5. Review retrieved Skill content before enabling it, especially any scripts, setup instructions, network destinations, and credential-handling behavior.
  6. Run installation in a least-privileged sandbox without production credentials or broad filesystem access.
  7. Document the exact approved package version, repository commit, expected digest, and verification procedure directly in SKILL.md.
  8. Replace duplicate unpinned commands at SKILL.md:481, SKILL.md:585, and SKILL.md:642-643 with the same immutable, verified references.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description says the skill can read/search spaces and messages, send messages and replies, download attachments, and manage reactions. However, the documented actions also include update_message and delete_message, which are materially broader write/destructive capabilities than merely sending messages and managing reactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill exposes destructive delete_message functionality, including a force option for threaded replies, without requiring confirmation or instructing the agent to obtain explicit user approval. In an agent context, this increases the chance of accidental or prompt-induced destructive actions against user communications, causing integrity loss and operational disruption.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 645)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/google-chat
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 646)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/google-chat
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Message creation with optional file attachments sends user-provided content into Google Chat, but the schema omits any privacy or integrity warning about external transmission. That increases risk of accidental disclosure, oversharing to the wrong space, or sending sensitive File Manager content into a live collaboration channel.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says the skill can read/search spaces and messages, send messages and replies, download attachments, and manage reactions. This schema also includes delete_message and update_message, which are materially different write/modification capabilities and are not mentioned in the stated description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes destructive deletion capability without any built-in warning or confirmation guidance, which increases the chance an agent or user will remove messages unintentionally. In a chat environment, deletion can destroy business records, disrupt collaboration, or remove evidence of prior actions, especially if the optional force flag deletes replies too.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Downloading chat attachments into File Manager creates a second stored copy of potentially sensitive data, but the schema provides no warning that data is being copied out of Chat into another storage system. This can lead to unintended retention, broader access, or policy violations if users assume the action is only viewing metadata rather than exporting content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Reply actions can post text and files into existing conversations, potentially notifying participants and disclosing sensitive information, yet the schema lacks any warning about the visibility and permanence of that action. In threaded discussions, an incorrect reply can leak confidential data to an entire room or create misleading audit trails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Uploading a File Manager file to Chat transmits stored content into an external communication channel, but the schema gives no warning that selected files will be shared with chat participants. This creates a straightforward exfiltration and accidental disclosure path, especially because the action only requires a file ID and target space.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The high-level 'What This Tool Does' summary emphasizes posting, reading, direct messaging, and reactions, which suggests a collaboration-focused interface, while later sections expose update_message and delete_message. This is not a direct contradiction about spaces, but the intent-level summary omits materially different destructive/editing behavior that the action list enables.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill documents downloading Chat attachments into AgentPMT File Manager without warning that this copies potentially sensitive data into another storage domain and may extend retention via expiration_days. In an agent setting, that can facilitate unintended data exfiltration, persistence of confidential files, or mishandling of regulated content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.