Gmail 1.0.6

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:58 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent Gmail integration, but it needs Review because it handles powerful Gmail access and includes unsafe guidance for sending, trashing, and exposing an API key.

Install only if you trust Maton with Gmail access and are comfortable routing Gmail operations through its managed OAuth gateway. Before using send, draft-send, label modification, trash, or connection deletion operations, require explicit user approval of the exact target and content. Do not print or share `MATON_API_KEY`; use a non-disclosing presence check and rotate the key if it has appeared in logs or transcripts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:303

Finding

API Key Exposed Through Terminal Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 303–309
Vulnerability Type: Credential disclosure through insecure troubleshooting guidance
Risk Level: Medium

bash

### Troubleshooting: API Key Issues

1. Check that the `MATON_API_KEY` environment variable is set:

```bash
echo $MATON_API_KEY

text

### Technical Analysis

The troubleshooting procedure instructs users or agents to print the complete `MATON_API_KEY` bearer credential to standard output. Verifying whether an environment variable is configured does not require revealing its value.

Terminal output may be retained in agent tool transcripts, CI/CD logs, shell recordings, support bundles, screen recordings, or copied diagnostic messages. Because the Skill uses this value directly as an authorization bearer token for `gateway.maton.ai` and `ctrl.maton.ai`, disclosure can enable credential reuse.

The broader transmission of the key and Gmail data to Maton's HTTPS endpoints is explicitly declared and is consistent with the Skill's third-party managed OAuth gateway design. The confirmed vulnerability is the unnecessary display of the complete secret, not the documented gateway transmission itself.

### Attack Path

1. A user experiences an authentication problem and follows the documented troubleshooting steps.
2. The user or agent runs `echo $MATON_API_KEY`.
3. The complete API key appears in terminal output.
4. That output is retained in a log, agent transcript, recording, or diagnostic report, or is shared with another party.
5. A party with access to the exposed output extracts the key.
6. The party submits the key as a bearer credential to Maton's gateway or connection-management API.
7. Subject to the key's server-side permissions and active OAuth connections, the party may access Gmail data or perform supported mailbox and connection-management operations.

### Impact Assessment

A disclosed key may permit impersonation of 
...[truncated 603 chars]

Remediation

View remediation

Remediation Suggestions

Replace the secret-printing command with a non-disclosing presence check:

bash

if [ -n "${MATON_API_KEY:-}" ]; then
  echo "MATON_API_KEY is set"
else
  echo "MATON_API_KEY is not set"
fi

Additional hardening measures:

1. Explicitly warn users never to print, paste, log, or share the API key.
2. Redact authorization headers and environment-variable values from agent output, CI logs, support bundles, and error telemetry.
3. If partial identification is required, display only a short fingerprint derived from the key rather than any reusable portion.
4. Rotate any key that has already appeared in logs, transcripts, recordings, or support messages.
5. Apply least-privilege Gmail OAuth scopes and restrict each key to only the connections and operations required.
6. Provide key revocation, expiration, and audit-log review procedures in the troubleshooting documentation.
7. Clearly communicate that Maton is a third-party processor for Gmail request and response data so users can make an informed authorization decision.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill describes outbound email sending without warning that message content will be transmitted to external recipients and may expose sensitive or unintended information. In an agent context, this creates a real risk of unauthorized or accidental data exfiltration through email if the model or user prompt is ambiguous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents a destructive mailbox operation (trash) without an explicit warning that it alters user data and may move messages out of the inbox or contribute to data loss if used carelessly. Because this skill is designed for automated agent use against a live Gmail account, omission of a user-facing confirmation/warning increases the risk of unintended destructive actions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete connection_id instead of a placeholder.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: SKILL.md:103