Daily Email Summary

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:08 AM UTC
• Version: 1.0.0

Overview

This Gmail summary skill is purpose-aligned, but it needs review because it handles private email and OAuth tokens with weak scoping and unsafe argument/content boundaries.

Install only if you are comfortable granting read-only Gmail access and having email text processed by the agent for summarization. Use a private credentials directory, review or restrict token.json permissions, avoid passing free-form arguments, and do not let the agent follow instructions contained inside emails without separate confirmation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39

Finding

Shell Command Injection Through Unsanitized Skill Arguments

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:43

Finding

Indirect Prompt Injection Through Untrusted Email Content

Content

View full analysis

1000: body = body[:1000] + "..." emails.append({ "id": msg['id'], "subject": subject, "from": sender, "date": date, "body": body, "snippet": message.get('snippet', '') }) ``` ### Technical Analysis Email headers, snippets, and bodies are attacker-controlled data. The script places this content directly into JSON consumed by the AI agent, while the Skill provides no instruction to treat message content only as untrusted data. An attacker can send an unread email containing text framed as instructions to the agent, such as requests to ignore the summarization task, disclose context, invoke tools, read files, or contact external services. Truncating the body to 1,000 characters limits volume but does not neutralize instruction-like content. The script itself does not execute email content. Exploitation occurs when the hosting agent interprets the retrieved content as instructions rather than solely as data to summarize. ### Attack Path 1. An attacker sends a crafted email to the victim’s Gmail account. 2. The email remains unread and therefore matches the `is:unread` Gmail query. 3. The Skill retrieves the message in full format. 4. The script includes the malicious body and snippet in its JSO ...[truncated 748 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_emails.py:40

Finding

OAuth Refresh Token Stored Without Enforced Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Non-Reproducible Third-Party Dependency Resolution

Content

View full analysis

=2.25.0 google-auth-oauthlib>=1.2.0 google-auth-httplib2>=0.2.0 google-api-python-client>=2.110.0 ``` `README.md:18`: ```bash pip install google-auth google-auth-oauthlib google-auth-httplib2 google-api-python-client ``` ### Technical Analysis The requirements specify only lower version bounds, while the README installs packages without any version constraints. Consequently, installations at different times can resolve to different package versions and transitive dependency sets. The package names are consistent with the declared Gmail API functionality, and no typosquatted package or unsafe package index was identified. The risk arises from accepting future releases without review and from the absence of cryptographic hash verification. Because Python packages execute code during installation and import, a compromised upstream release or dependency could affect the host before the Skill runs. ### Attack Path 1. A user follows the README installation command or installs from the broad version ranges. 2. `pip` resolves the newest releases satisfying the constraints. 3. A compromised, malicious, or unexpectedly incompatible future release is selected. 4. Package installation or import executes the affected code with the user’s privileges. 5. The compromised dependency can access local files, OAuth credentials, tokens, email output, and available network resources. This finding identifies supply-chain exposure rather than evidence that any currently named package is malicious. ### Impact Assessment The maximum impact is code execution with the privileges of the account installing or running the Skill. Accessible assets may include Gmail credentials, OAuth tokens, email content, and oth ...[truncated 163 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

- Click "Create Credentials" > "OAuth client ID"
   - Choose "Desktop app" as application type
   - Download the credentials JSON file
5. Save the credentials file to a secure location (e.g., `~/.config/gmail/credentials.json`)

### 3. Set Environment Variable

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

md

- Click "Create Credentials" > "OAuth client ID"
   - Choose "Desktop app" as application type
   - Download the credentials JSON file
5. Save the credentials file to a secure location (e.g., `~/.config/gmail/credentials.json`)

### 3. Set Environment Variable

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose emphasizes concise email summaries, but the described behavior implies reading full unread email contents and possibly returning raw or truncated bodies while using Gmail OAuth credentials. That mismatch is dangerous because it can cause over-collection and over-exposure of highly sensitive private communications beyond what the user reasonably expects from the description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill does not clearly warn users that it accesses private Gmail messages and may send email content through an AI summarization flow. In this context, the missing disclosure is especially dangerous because email bodies often contain credentials, financial information, personal data, and legal or business-sensitive content that users may not expect to be processed or transmitted.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

md

### 2. Set Up Gmail API Credentials

1. Go to [Google Cloud Console](https://console.cloud.google.com/)
2. Create a new project (or select an existing one)
3. Enable the Gmail API:
   - Navigate to "APIs & Services" > "Library"
   - Search for "Gmail API"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill requests access to sensitive resources and behaviors—environment variables, network access, and implied file writes for credential/token handling—without declaring an explicit tool scope or permissions boundary. This creates a transparency and least-privilege failure: an agent or user may invoke the skill without understanding it can access Gmail credentials, contact Gmail over the network, and potentially persist OAuth tokens.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation text is broad enough to match many ordinary email-related requests, increasing the chance the skill is auto-invoked in situations where the user did not specifically consent to Gmail access. In the context of a skill that reads private inbox contents, overbroad triggering raises the risk of unintended data access and unnecessary transmission of sensitive email content for summarization.

Content

No source excerpt is available for this finding.

Tainted flow: 'token_path' from os.getenv (line 40, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/fetch_emails.py (reported line 59)May include surrounding context.

python

creds = flow.run_local_server(port=0)

        # Save the credentials for the next run
        with open(token_path, 'w') as token:
            token.write(creds.to_json())

    return creds, None

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises concise summaries but actually returns raw message bodies and snippets, causing substantially more mailbox content to be exposed to the agent or downstream consumers than users would reasonably expect. In an email-reading skill, this mismatch increases privacy risk because sensitive content may be transmitted, logged, or processed unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script prints fetched email subjects, senders, snippets, and body content directly as JSON, which can expose sensitive mailbox data to logs, calling processes, or other components without any explicit disclosure boundary. In the context of an agent skill, this is more dangerous because the output is designed for machine consumption and may be retained, forwarded, or incorporated into broader workflows automatically.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only, allowing future unreviewed versions to be installed. This weakens build reproducibility and can introduce vulnerable or breaking upstream releases into a skill that handles sensitive Gmail access tokens and email data.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

google-auth>=2.25.0
google-auth-oauthlib>=1.2.0
google-auth-httplib2>=0.2.0
google-api-python-client>=2.110.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using an unpinned version for google-auth-oauthlib permits installation of any newer release that satisfies the minimum version, including potentially vulnerable or maliciously compromised versions. Because this skill performs OAuth flows for Gmail access, supply-chain instability is somewhat more sensitive than in a non-privileged utility.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

google-auth>=2.25.0
google-auth-oauthlib>=1.2.0
google-auth-httplib2>=0.2.0
google-api-python-client>=2.110.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The package is not pinned to an exact version, so deployments may resolve to different dependency versions over time. In a skill integrating with Gmail APIs, this increases supply-chain risk and can affect authentication or HTTP transport behavior unexpectedly.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

google-auth>=2.25.0
google-auth-oauthlib>=1.2.0
google-auth-httplib2>=0.2.0
google-api-python-client>=2.110.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

A minimum-only version constraint for google-api-python-client allows unreviewed newer versions into production, reducing reproducibility and increasing exposure to upstream security or compatibility issues. Since this library is used to access Gmail data, dependency integrity matters more than for low-privilege components.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

google-auth>=2.25.0
google-auth-oauthlib>=1.2.0
google-auth-httplib2>=0.2.0
google-api-python-client>=2.110.0

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest says the skill fetches recent emails from Gmail, but the inline comment and query explicitly target unread messages only. This is an intent-level contradiction because 'recent' and 'unread' are different selection criteria and could materially change behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.