ClawHub
Back to skill

Security audit

google-apps-script

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Maton integration for managing Google Apps Script, with powerful write and automation features that require user confirmation.

Install this only if you trust Maton's CLI and SDK package channels. Prefer OAuth over long-lived API keys, use the narrowest Google account and scopes available, confirm every Apps Script write, deployment, deletion, or script run, and be especially careful before creating triggers or destinations that forward data continuously.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:37
Finding
Third-Party CLI Installation Without Artifact Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37-43` **Vulnerability Type**: Supply-chain integrity weakness **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @maton/cli@0.3.1 ``` ```bash brew install maton-ai/cli/maton brew pin maton ``` ### Technical Analysis The Skill instructs users to install and execute a third-party CLI from npm or a custom Homebrew tap. Although the npm version is pinned and Homebrew is pinned after installation, the instructions do not verify an artifact checksum, package signature, source commit, or reproducible-build provenance. Version pinning prevents unexpected upgrades but does not establish that the downloaded artifact is authentic. If the package publisher, registry account, distribution infrastructure, or custom Homebrew tap is compromised, the pinned artifact could be replaced or republished with malicious content. A global npm installation also increases exposure because package installation scripts execute with the installing user's privileges and the resulting executable is placed in the user's global command path. ### Attack Path 1. An attacker compromises the package publisher, npm registry entry, Homebrew tap, or associated release infrastructure. 2. The attacker replaces the referenced release with a malicious artifact while retaining the expected package and version identifiers. 3. A user follows the Skill instructions and installs the package. 4. Package installation hooks or the installed CLI execute attacker-controlled code locally. 5. The malicious code accesses data available to the installing user, potentially including Maton sessions, API credentials, local files, and data returned from connected Google Apps Script accounts. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. The resulting scope may include: - Access to Maton authentication state available to the local user. ...[truncated 526 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Publish cryptographic SHA-256 checksums for every reviewed CLI artifact and require users to verify them before installation. 2. Sign releases using a verifiable mechanism such as Sigstore, npm provenance attestations, or platform-specific code signing. 3. Document the expected publisher identity, release URL, signing identity, and verification commands. 4. Prefer installation in an isolated environment instead of a global npm installation. 5. Provide reproducible-build instructions and link each package release to a reviewed source commit. 6. For Homebrew, pin the formula to a versioned release artifact with a fixed checksum rather than relying only on `brew pin`, which acts after installation. 7. Recommend execution under an account with access only to the connections required for the current task. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:1378
Finding
Optional SDK Dependencies Installed Without Signature or Checksum Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1378-1395` **Vulnerability Type**: Supply-chain integrity weakness **Risk Level**: Medium ### Vulnerable Code ```bash pip install 'maton-ai==0.3.1' ``` ```python from maton_ai import Maton, login # login() maton = Maton() # maton = Maton(api_key="...") result = maton.api.get("google-apps-script", "/v1/processes") ``` ```bash npm install @maton/sdk@0.3.1 ``` ```javascript import { Maton, login } from "@maton/sdk"; // await login() const maton = new Maton(); // const maton = new Maton({ apiKey: "..." }); const result = await maton.api.get("google-apps-script", "/v1/processes"); ``` ### Technical Analysis The optional Python and JavaScript SDK workflows install executable dependencies from public package registries and then import them into processes that can authenticate to Maton. Exact version pins reduce dependency drift, but the instructions provide no hashes, signatures, lockfile integrity records, or provenance verification. A malicious or replaced package can execute during installation, import, SDK initialization, or API calls. Because these processes may hold authenticated Maton sessions or API keys, compromise could expose both local credentials and data reachable through connected services. ### Attack Path 1. An attacker compromises a package publisher account, registry entry, build pipeline, or package distribution channel. 2. A malicious artifact is distributed under the documented package name and pinned version. 3. A user installs the dependency by following the Skill documentation. 4. Malicious installation hooks or imported module initialization code executes. 5. The package captures authentication state, request data, or API responses and uses the process's local privileges for additional access. ### Impact Assessment Successful exploitation could result in code execution as the application user and compromise of: - Maton API keys passed to or available within the S ...[truncated 513 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. For Python, publish and require exact wheel or source-distribution hashes, using a hash-locked requirements file and `pip install --require-hashes`. 2. For JavaScript, provide a reviewed lockfile with integrity fields and recommend deterministic installation through `npm ci`. 3. Publish signed provenance attestations for both SDK packages and document how users can verify the publisher identity. 4. Tie each package artifact to a specific reviewed source commit and provide reproducible-build documentation. 5. Disable dependency installation scripts where compatible with functionality, or explicitly document and audit every required installation hook. 6. Run SDK applications in isolated environments with only the credentials and connections required for the current operation. 7. Avoid embedding API keys directly in source code; retain the documented OAuth or protected secret-store workflow. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.