Gmail Cleaner

• Analyzed: May 11, 2026, 4:40 AM
• Findings: 1
• Version: 1.0.0
• Hash: 98d4406b2c697a88630bd48743228bafca701ddae34cf3d354ccf210e95bd26c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of `os.system` for package installation and `pickle.load` for deserializing authentication tokens. While `os.system` in `scripts/auth.py`, `scripts/clean.py`, `scripts/deep_clean.py`, `scripts/organize.py`, `scripts/restore.py`, and `scripts/scan.py` is used with hardcoded arguments for installing known dependencies, it represents a direct shell execution vulnerability if the execution environment or `sys.executable` path were compromised. Additionally, `pickle.load` (used across all scripts to load `gmail_token.pkl`) is a known deserialization vulnerability that could lead to arbitrary code execution if an attacker were able to replace the token file with a malicious payload. These are significant vulnerabilities, not malicious intent, aligning with a 'suspicious' classification.