ClawHub
Back to skill

Security audit

slidesmith

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Google Slides editing helper, but users should handle its live-deck writes and OAuth credential fallbacks carefully.

Install only if you want an agent to operate on Google Slides decks through the slidesmith CLI. Treat push, replace-image, group, reorder, create, and share as live Google Drive/Slides actions; review diffs, use dry-run where available, and prefer test copies for important decks. Use OS keyring or managed secrets for OAuth material, avoid the insecure credential-file fallback unless you understand the local storage risk, and revoke/rotate tokens if credential files are exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:63
Finding

Insecure Credential Storage Fallback

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–72
Vulnerability Type: Insecure storage of OAuth credentials
Risk Level: Medium

Vulnerable Code:

text
Newer gog versions may store only the OAuth client ID in `credentials.json` and
keep the client secret in the OS keyring. `slidesmith auth doctor` checks both;
if the keyring read is unavailable, follow its macOS Keychain guidance or use
`GOG_ACCESS_TOKEN` / `gog auth credentials <file> --insecure` as a fallback.
In a non-interactive process, keyring calls time out after 5 seconds instead of
hanging on a Keychain prompt, and session-token operations fall back to the
0600 file store. Set `SLIDESMITH_KEYRING_TIMEOUT=<float-seconds>` to override
that bound, or `SLIDESMITH_KEYRING_TIMEOUT=0` to disable all keyring access;
`SLIDESMITH_TOKEN_STORE=file` selects only the session store, not gogcli's
bounded client-secret lookup.

Technical Analysis

The Skill recommends gog auth credentials <file> --insecure when secure keyring access is unavailable. This fallback can store OAuth client credentials outside an operating-system-backed credential vault. File permissions such as mode 0600 reduce access by other local users but do not provide encryption at rest or protection from processes running under the same user account.

The same section also documents options that disable keyring access and select a file-based token store. If these options are used without an external secret manager or equivalent protection, OAuth client secrets or session tokens may be exposed through local files, backups, filesystem snapshots, malware operating as the user, or accidental workspace disclosure.

Attack Path

  1. Secure keyring access is unavailable, times out, or is disabled.
  2. The user follows the documented fallback and imports credentials using gog auth credentials <file> --insecure, or selects file-based token storag ...[truncated 1134 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to use gog auth credentials <file> --insecure as a routine fallback.
  2. Require an operating-system-backed keyring or an approved external secret manager for persistent OAuth client secrets and refresh tokens.
  3. For non-interactive environments, inject short-lived access tokens through a protected CI/CD secret facility rather than persisting them in a workspace.
  4. If file storage is unavoidable, store credentials outside the project directory, enforce owner-only permissions, use encrypted storage, exclude the location from backups and version control, and document secure deletion procedures.
  5. Warn users that environment variables may be exposed through process inspection, crash reports, logs, or CI diagnostics; ensure commands never print token values.
  6. Document token rotation and revocation procedures for cases where insecure storage may already have been used.
  7. Fail closed when protected credential storage is unavailable instead of silently or routinely degrading to plaintext file storage.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

slidesmith --version # print the installed package version

text

Newer gog versions may store only the OAuth client ID in `credentials.json` and
keep the client secret in the OS keyring. `slidesmith auth doctor` checks both;
if the keyring read is unavailable, follow its macOS Keychain guidance or use
`GOG_ACCESS_TOKEN` / `gog auth credentials <file> --insecure` as a fallback.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
Newer gog versions may store only the OAuth client ID in `credentials.json` and
keep the client secret in the OS keyring. `slidesmith auth doctor` checks both;
if the keyring read is unavailable, follow its macOS Keychain guidance or use
`GOG_ACCESS_TOKEN` / `gog auth credentials <file> --insecure` as a fallback.
In a non-interactive process, keyring calls time out after 5 seconds instead of
hanging on a Keychain prompt, and session-token operations fall back to the

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
Newer gog versions may store only the OAuth client ID in `credentials.json` and
keep the client secret in the OS keyring. `slidesmith auth doctor` checks both;
if the keyring read is unavailable, follow its macOS Keychain guidance or use
`GOG_ACCESS_TOKEN` / `gog auth credentials <file> --insecure` as a fallback.
In a non-interactive process, keyring calls time out after 5 seconds instead of
hanging on a Keychain prompt, and session-token operations fall back to the

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description says to use the skill for "any task" that creates or restyles Google Slides, which is a very broad activation description for a markdown/manifest file. It does not provide explicit trigger constraints or negative examples, increasing the chance of unintended invocation for ordinary presentation-editing requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill prominently instructs users to pull, edit, diff, and push changes back to the same live deck, and notes that a human can have the deck open while changes are pushed. Although it mentions diffing and revision locks later, it does not present an upfront high-visibility warning that actions modify live user data, which increases the risk of accidental destructive or unauthorized changes in normal agent use.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
In a non-interactive process, keyring calls time out after 5 seconds instead of
hanging on a Keychain prompt, and session-token operations fall back to the
0600 file store. Set `SLIDESMITH_KEYRING_TIMEOUT=<float-seconds>` to override
that bound, or `SLIDESMITH_KEYRING_TIMEOUT=0` to disable all keyring access;
`SLIDESMITH_TOKEN_STORE=file` selects only the session store, not gogcli's
bounded client-secret lookup.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This recipe includes commands that can modify and push changes back to the same live Google Slides deck, but it does not prominently warn the user at the point of use that push affects production content. In an agent or copy-paste workflow, that increases the chance of accidental changes to a real deck, especially because the skill is explicitly designed for in-place editing of native assets rather than exporting a disposable file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.