Security audit

gog-restricted

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it needs Review because its Google Workspace safety wrapper appears vulnerable to an argument-parsing bypass that could undermine blocked Gmail or Calendar actions.

Install only if you are comfortable granting this skill access to the Google account already authorized for gog, and treat the wrapper as needing a security fix before relying on it to block sending email, destructive Gmail actions, or Calendar mutations. Prefer a profile-isolated install directory and verify the wrapper is updated to parse and execute the same normalized arguments before using it with sensitive accounts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: script/setup.sh:123
Finding: Command Allowlist Bypass Through Incorrect Long-Option Parsing
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes shell-backed capabilities through the required gog-restricted binary, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. Without an explicit allowlist, an agent platform may grant broader execution latitude than intended or make the shell capability less auditable, increasing the risk of misuse despite the wrapper's internal command restrictions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This shell script creates and later installs a new executable into a user-writable directory on PATH, which changes the user's command environment. Although the code includes technical status messages and overwrite guards, it does not provide a clear user-facing warning or confirmation before performing this persistent filesystem modification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.