Howtoletmyagent Secure Gmail Access

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:17 AM UTC
• Version: 0.1.0

Overview

This skill is not malicious, but it delegates a sensitive Gmail OAuth setup to a mutable external article without locally pinning the exact safe procedure or allowed scopes.

Review the external article and requested Gmail scopes before using this skill. Do not approve Gmail read, modify, send, or delete permissions unless they are specifically needed, and do not share OAuth client secrets, authorization codes, access tokens, refresh tokens, or mailbox contents with untrusted sites.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:11

Finding

Mutable External Instructions Control a Sensitive Gmail OAuth Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–19 and 42–43
Vulnerability Type: External instruction redirection
Risk Level: Medium

Vulnerable Code

markdown

- Source article: https://howtoletmyagent.xyz/articles/how-to-let-my-openclaw-agent-get-secure-gmail-access
- Risk level: medium
- Tags: Gmail, OAuth2, Security, ClawHub, Google Workspace

Primary behavior:

- Treat the article above as the canonical source for this workflow.
- Follow the recommended approach from the article instead of inventing alternate setups.
- Call out risk, credentials, destructive actions, and approval points before making changes.
- If the user's environment differs from the article, inspect first and adapt carefully.

markdown

If the user asks you to perform the workflow end-to-end, use the source article as the baseline procedure and keep the user informed about any deviations or missing prerequisites.

Technical Analysis

The skill delegates its effective instructions for a security-sensitive Gmail OAuth setup to a mutable external webpage and explicitly requires the agent to treat that page as the canonical procedure. The local package does not include the complete procedure, pin an immutable version or content digest, define an approved-domain trust policy, or explicitly allowlist acceptable Gmail OAuth scopes.

Consequently, reviewing the local skill does not fully determine the instructions that the agent will follow at invocation time. If the external page is compromised, transferred, or modified, its new content could influence the agent's current-session goals and security decisions. Because the workflow concerns Google Cloud configuration, OAuth credentials, and Gmail scopes, malicious instructions could request excessive permissions, unsafe credential handling, or unrelated commands.

The reviewed file does not itself contain an executable payload, credential-stealing command, or ...[truncated 1823 chars]

Remediation

View remediation

Remediation Suggestions

1. Embed the complete reviewed OAuth setup procedure directly in SKILL.md or another version-controlled file within the skill package.
2. Treat the external article as optional background material rather than as canonical executable guidance.
3. If remote content must be used, pin an immutable version and verify it against a cryptographic digest before relying on it.
4. Define an explicit allowlist of acceptable Gmail OAuth scopes and default to the least-privileged scope that satisfies the user's stated task.
5. Require separate, informed user confirmation before adding scopes, creating credentials, disclosing secrets, or performing actions that can read, modify, delete, or send email.
6. State that instructions obtained from external content must not override system policies, skill safety constraints, the user's stated objective, or credential-handling requirements.
7. Prohibit transmitting OAuth client secrets, authorization codes, access tokens, refresh tokens, or mailbox content to the referenced site or any unapproved third party.
8. Validate remote recommendations against official Google OAuth and Gmail API documentation before presenting or executing them.
9. Record and display any deviation from the locally reviewed procedure, including the exact additional scope or action requested and its security consequences.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep