ClawHub
Back to skill

Security audit

Gog Bwm

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Google Workspace CLI skill, but it combines broad Google account access with an unpinned third-party Homebrew install and data-changing commands.

Review the Homebrew tap and `gogcli` publisher before installing, do not run it as root, and authorize only the Google services you actually need. Be especially careful with commands that send mail, create calendar events, or modify and clear Sheets data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party Homebrew Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}}

Technical Analysis

The installation metadata directs users to install gogcli from the third-party Homebrew tap steipete/tap without pinning an immutable package version, repository commit, or integrity digest. Consequently, the package and formula executed during installation may differ from the versions available when this Skill was audited.

This creates a supply-chain trust boundary: compromise of the tap, its publisher account, the package source, or associated release infrastructure could introduce arbitrary installation or runtime code without requiring changes to this repository. The project itself does not contain an observed malicious payload; the risk arises from mutable external dependency resolution.

Attack Path

  1. An attacker compromises the third-party tap, its maintainer account, or an upstream release artifact referenced by the formula.
  2. The attacker modifies the formula or package so that installation or execution runs malicious code.
  3. A user installs the dependency through the Skill's Homebrew installation metadata.
  4. Homebrew retrieves and executes the modified installation logic or installs the altered binary.
  5. The malicious process runs with the installing user's privileges.
  6. If the user has configured gog OAuth credentials, the malicious component may attempt to access locally available credentials or Google Workspace resources authorized for that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running Homebrew or invoking gog ...[truncated 499 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer a verified official distribution channel controlled by the upstream project.
  • Pin the dependency to an immutable version or repository commit rather than resolving a mutable formula implicitly.
  • Verify downloaded artifacts using a publisher-provided cryptographic checksum or signature.
  • Review and lock the Homebrew formula contents used for installation, including all upstream URLs and checksums.
  • Document the expected package publisher, version, and integrity value so users can validate the dependency before installation.
  • Run installation and the CLI under least privilege; do not invoke Homebrew or gog as root.
  • Store OAuth credentials using operating-system-protected credential storage and authorize only the Google Workspace services required for the user's task.
  • Establish dependency monitoring and periodically reassess the tap and upstream release infrastructure for ownership or integrity changes.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`