T08 · Insecure Dependencies
Warning
- Location
SKILL.md:25- Finding
Unpinned Installation of Security-Critical Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Civic Google
Security checks for vulnerabilities and agentic risk
Overview
The skill transparently describes a Google CLI OAuth helper that handles sensitive tokens, with cautions around external installs and gateway isolation rather than hidden behavior.
Install this only if you are comfortable letting Civic broker OAuth access to your Google Workspace data and letting agents run gog commands within scopes you approve. Use the least Google scopes needed, isolate the OpenClaw gateway environment, avoid exposing environment variables in logs, and consider pinning or verifying the plugin and gog versions before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **What is sent to Civic:** The plugin sends the `gog` command prefix (e.g. `gog gmail send`) over HTTPS to `app.civic.com` for scope resolution. The proxy reads only the command prefix to determine which OAuth scope is needed — command arguments (email addresses, search queries, file names) are not logged, stored, or used by the proxy. - **CIVIC_TOKEN:** This is the user's own API key from their Civic account at app.civic.com. It authenticates the user to their own account and is never shared. It is sent as a Bearer token over HTTPS. - **Token handling:** OAuth access tokens are short-lived (~1 hour), stored encrypted (AES-256) on Civic's servers, and refreshed automatically. The agent never sees OAuth client secrets or refresh tokens. - **Source code:** The plugin is open source at https://github.com/civicteam/openclaw-google and published on npm as `@civic/openclaw-google`. ## Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
The documented design sets a short-lived OAuth access token into the GOG_ACCESS_TOKEN environment variable before invoking gog. Environment variables can be exposed to subprocesses, crash dumps, debug logs, process inspection, or other tooling in the same execution environment, making token leakage possible if the runtime is not tightly isolated.
- Content
md 2. Plugin intercepts the `exec` tool call via a `before_tool_call` hook 3. Plugin sends the command prefix to the Civic proxy for scope resolution 4. Proxy matches `gog gmail` -> `gmail.readonly` scope 5. If authorized: returns a short-lived access token, plugin sets `GOG_ACCESS_TOKEN` env var, `gog` runs 6. If not yet authorized: blocks the tool call and surfaces an auth URL for the user to consent 7. After first consent per scope, all future calls work automatically