ClawHub
Back to skill

Security audit

Draft Machine

Security checks for vulnerabilities and agentic risk

Overview

This Gmail mail-merge skill is coherent and not malicious, but it asks agents to install and authorize mutable third-party software for Gmail access without pinning or integrity checks.

Before installing, review and pin the DraftMachine package and the skill source to a trusted version or commit, preferably in an isolated environment. Only proceed if you are comfortable granting DraftMachine Gmail draft access and storing OAuth material under ~/.draftmachine; preview outputs before creating drafts and review all Gmail drafts before sending.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned Installation of a Gmail-Authorized Third-Party Package

Content
View full analysis
Remediation
View remediation
" ``` 2. Publish and verify a cryptographic hash through a requirements file: ```text draftmachine== \ --hash=sha256: ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Identify the expected official publisher and package URL explicitly so users can detect dependency confusion or similarly named packages. 4. Require explicit user approval before installing executable third-party software. 5. Prefer an isolated virtual environment rather than modifying the user's global Python environment. 6. Review package updates before changing the pinned version, including the source, distribution artifacts, dependencies, and requested Gmail OAuth scope. ]]>

T08 · Insecure Dependencies

Warning
Location
README.md:18
Finding

Mutable Remote Skill Installation Without a Commit or Release Pin

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
| File | Purpose |
|------|---------|
| `~/.draftmachine/client_secret.json` | OAuth app credential downloaded from Google Cloud Console |
| `~/.draftmachine/creds.json` | Cached OAuth token (created automatically by `draftmachine setup`) |

Check for them:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
| File | Purpose |
|------|---------|
| `~/.draftmachine/client_secret.json` | OAuth app credential downloaded from Google Cloud Console |
| `~/.draftmachine/creds.json` | Cached OAuth token (created automatically by `draftmachine setup`) |

Check for them:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
| File | Purpose |
|------|---------|
| `~/.draftmachine/client_secret.json` | OAuth app credential downloaded from Google Cloud Console |
| `~/.draftmachine/creds.json` | Cached OAuth token (created automatically by `draftmachine setup`) |

Check for them:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
| File | Purpose |
|------|---------|
| `~/.draftmachine/client_secret.json` | OAuth app credential downloaded from Google Cloud Console |
| `~/.draftmachine/creds.json` | Cached OAuth token (created automatically by `draftmachine setup`) |

Check for them:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
| File | Purpose |
|------|---------|
| `~/.draftmachine/client_secret.json` | OAuth app credential downloaded from Google Cloud Console |
| `~/.draftmachine/creds.json` | Cached OAuth token (created automatically by `draftmachine setup`) |

Check for them:

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx skills add johnkennedy/DraftMachineSkill without pinning a specific version or commit, which means the installed package content can change over time and may pull a compromised or unexpected release. In a security-sensitive agent skill context, this creates a supply-chain risk because users may execute remotely fetched code or skill definitions with no reproducibility guarantees.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill says to trigger for requests like "send personalized emails to my contacts," "draft outreach emails," and "email everyone on this list," and then broadens this further to "any time the user wants to compose similar emails to multiple people at once." These phrases overlap with common user intents and do not provide exclusion conditions or clear boundaries for when this skill should not be invoked.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
Tell the user they need to do a one-time setup to connect DraftMachine to their Gmail:

1. Go to [Google Cloud Console](https://console.cloud.google.com/) and create a project (or pick an existing one).
2. Navigate to **APIs & Services → Enable APIs & Services** and enable the **Gmail API**.
3. Go to **APIs & Services → Credentials → Create Credentials → OAuth client ID**.
4. Choose **Desktop app** as the application type.

Static analysis

No suspicious patterns detected.