Security audit

google-autoreply

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated merchant-onboarding purpose, but it instructs agents to handle long-lived session tokens in URLs and persistent environment variables, creating a real account-security review concern.

Review this carefully before installing. Use it only if you are comfortable letting an agent authenticate to the merchant backend, connect or disconnect a Google Business Profile, enable automated review replies, manage store keywords, and potentially send the merchant to Stripe checkout after trial expiry. The publisher should replace token-in-URL flows with short-lived authorization codes or opaque handoff IDs, shorten token lifetime, and add clear consent prompts before each account, business-profile, and billing step.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:15
Finding: Long-Lived Session Bearer Token Exposed Through URLs and Redirects
Content: View full analysis
`). Set once after Step 1 and reused verbatim for **every** backend API call and the next session. Re-authorize only when the API returns `401`. ... - **Token lifetime (checked)**: login/session JWT is long-lived (`jwt.expiration` ≈ 7 years). ``` ```markdown Connect Google Business = {API_BASE_URL}/oauth2/connectGoogleBusiness?token=&redirectState= ``` ```markdown 1. `POST /oauth2/handoff/create` with `returnUrl=` (e.g. a URL the invoking application — workbuddy / openclaw — listens on). Response `data.handoffId` (one-time slot, usable for 3 min). If `returnUrl` is omitted the login falls back to the product login page. 2. Give the merchant this URL: `{API_BASE_URL}/oauth2/authorization/google-autoreply?handoffId=` and ask them to complete the sign-in. After login the browser is **redirected back to `returnUrl` with `token` & `tokenHead` appended** (e.g. `returnUrl?token=...&tokenHead=...`). ``` ```markdown {API_BASE_URL}/oauth2/connectGoogleBusiness?token=&redirectState= ``` ### Technical Analysis The Skill directs the agent to place a reusable bearer credential in URL query parameters in two flows: 1. The Google Business connection URL includes the session token as the `token` query parameter. 2. The SSO callback appends `token` and `tokenHead` to the configured `returnUrl`. URL encoding does not protect a credential from disclosure. Query strings may be retained or transmitted through: - Browser history and address-bar synchronization. - Revers ...[truncated 3074 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation description is broad enough to trigger sensitive account, OAuth, and payment-related actions from loosely phrased user requests such as 'set up an account' or 'check membership.' In a skill that can initiate sign-in, connect third-party business accounts, and route users into billing flows, vague triggers increase the chance of the agent entering high-impact workflows without clear user consent or scope confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to perform account onboarding, OAuth authorization, token handling, and Stripe checkout flows but does not present an explicit privacy, account-impact, or financial-impact warning to the user before those steps. Because the workflow includes linking external Google Business accounts and potentially initiating paid subscription checkout after trial expiry, omission of clear warnings and consent gates can lead to unintended account changes, disclosure of business data, or accidental payment actions.
Content: No source excerpt is available for this finding.