Civic Google

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:12 AM UTC
• Version: 0.1.1

Overview

The skill transparently describes a Google CLI OAuth helper that handles sensitive tokens, with cautions around external installs and gateway isolation rather than hidden behavior.

Install this only if you are comfortable letting Civic broker OAuth access to your Google Workspace data and letting agents run gog commands within scopes you approve. Use the least Google scopes needed, isolate the OpenClaw gateway environment, avoid exposing environment variables in logs, and consider pinning or verifying the plugin and gog versions before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25
• Finding: Unpinned Installation of Security-Critical Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25-32 **Vulnerability Type**: Supply-chain risk from mutable, unpinned third-party packages **Risk Level**: Medium ### Vulnerable Code ```bash openclaw plugins install @civic/openclaw-google ``` ```bash brew install gog ``` ### Technical Analysis The setup instructions install `@civic/openclaw-google` and `gog` from external package distribution systems without specifying immutable versions, package digests, source revisions, or signature-verification procedures. Consequently, the code installed by these commands can differ from the code that was originally reviewed. This is security-sensitive because the documented plugin intercepts `exec` tool calls through a `before_tool_call` hook, accesses the `CIVIC_TOKEN` environment variable, obtains short-lived Google OAuth access tokens, and injects `GOG_ACCESS_TOKEN` into the execution environment. A compromised or malicious dependency could abuse these capabilities. The audit cannot establish that either current dependency is malicious. The confirmed weakness is that the installation process does not guarantee dependency integrity or reproducibility. ### Attack Path 1. An attacker compromises a dependency publisher account, package registry, distribution channel, or upstream release process. 2. The attacker publishes a malicious release under the documented package or formula name. 3. A user follows the setup instructions, which retrieve the current mutable release without validating a version, digest, signature, or reviewed source revision. 4. The malicious dependency executes within the OpenClaw gateway or Google CLI context. 5. The dependency intercepts tool calls, reads accessible environment credentials, captures issued Google access tokens, or alters Google operations. 6. The attacker uses the captured credentials or modified operations within the permissions granted to the process and authorized Google scopes. ### Impact Assessme ...[truncated 797 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@civic/openclaw-google` to a specifically reviewed version rather than installing the latest mutable release. 2. Where supported, pin dependencies using immutable package digests, lockfiles, or exact source commit hashes. 3. Document package integrity and signature-verification procedures before installation. 4. Pin or otherwise verify the exact Homebrew formula and binary revision used for `gog`. 5. Generate and retain a software bill of materials for the plugin and CLI, including transitive dependencies. 6. Review and vendor security-critical plugin code where operationally feasible. 7. Run the OpenClaw gateway and `gog` with minimal operating-system permissions and in an isolated execution environment. 8. Restrict plugin access to environment variables so it cannot read unrelated credentials. 9. Authorize only the minimum required Google OAuth scopes and revoke scopes when they are no longer needed. 10. Monitor installed package versions and require security review before upgrades. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

- **What is sent to Civic:** The plugin sends the `gog` command prefix (e.g. `gog gmail send`) over HTTPS to `app.civic.com` for scope resolution. The proxy reads only the command prefix to determine which OAuth scope is needed — command arguments (email addresses, search queries, file names) are not logged, stored, or used by the proxy.
- **CIVIC_TOKEN:** This is the user's own API key from their Civic account at app.civic.com. It authenticates the user to their own account and is never shared. It is sent as a Bearer token over HTTPS.
- **Token handling:** OAuth access tokens are short-lived (~1 hour), stored encrypted (AES-256) on Civic's servers, and refreshed automatically. The agent never sees OAuth client secrets or refresh tokens.
- **Source code:** The plugin is open source at https://github.com/civicteam/openclaw-google and published on npm as `@civic/openclaw-google`.

## Setup

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. Plugin intercepts the `exec` tool call via a `before_tool_call` hook
3. Plugin sends the command prefix to the Civic proxy for scope resolution
4. Proxy matches `gog gmail` -> `gmail.readonly` scope
5. If authorized: returns a short-lived access token, plugin sets `GOG_ACCESS_TOKEN` env var, `gog` runs
6. If not yet authorized: blocks the tool call and surfaces an auth URL for the user to consent
7. After first consent per scope, all future calls work automatically

• Confidence: 83% confidence
• Finding: The documented design sets a short-lived OAuth access token into the GOG_ACCESS_TOKEN environment variable before invoking gog. Environment variables can be exposed to subprocesses, crash dumps, debug logs, process inspection, or other tooling in the same execution environment, making token leakage possible if the runtime is not tightly isolated.

Static analysis

No suspicious patterns detected.