gmailcleanerfall

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This is framed as a Gmail reader, but the included artifacts also allow modifying, deleting, sending, and scheduling email actions, so it needs review before installation.

Install only if you want the full Gmail management pack, not just a reader. For read-only use, remove or disable organizer/responder/scheduler components, use least-privilege Gmail credentials, avoid enabling cron/auto modes, and review every delete/send/bulk action before approving it.

Static analysis

Prompt injection instructions

Warn

Finding: Prompt-injection style instruction pattern detected.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

High

What this means

A token issued for this skill could be used to change mailbox state or create/send email drafts, not only read messages.

Why it was flagged

The fallback OAuth flow requests Gmail modify and compose permissions, not just read-only access, which exceeds the root email-reader purpose.

Skill content

SCOPES = ["https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/gmail.modify", "https://www.googleapis.com/auth/gmail.compose"]

Recommendation

Use a separate read-only credential for the reader skill, split mutating responder/organizer features into separately approved skills, and clearly declare all requested scopes.

ASI02: Tool Misuse and Exploitation

High

What this means

A mistaken or overbroad query could modify or delete hundreds of emails before the user notices.

Why it was flagged

The script can run bulk mailbox actions, including delete/trash/archive/move, over query-derived IDs with no enforced confirmation in this code path.

Skill content

choices=["trash","untrash","archive","read","unread","star","unstar","move","delete"] ... p.add_argument("--max",type=int,default=500) ... ok=do_action(svc,ids,a.action,a.move_to)

Recommendation

Add a mandatory dry-run and explicit confirmation showing the exact action, count, and query before any destructive or bulk operation; keep permanent delete disabled by default.

ASI10: Rogue Agents

Medium

What this means

If enabled, email checks or cleanup actions can keep running after the current task and may affect mail repeatedly.

Why it was flagged

The scheduler instructions describe persistent heartbeat, cron, auto, and continuous loop modes for email automation.

Skill content

"heartbeat": {"every": "30m" ...} ... python3 scripts/scheduler.py --once --auto ... # Loop continuo ... python3 scripts/scheduler.py --interval 30

Recommendation

Do not enable heartbeat, cron, loop, or --auto modes unless the user explicitly opts in; provide a clear disable path and require confirmations for mutating scheduled actions.

ASI01: Agent Goal Hijack

Medium

What this means

Analysis results such as priority, phishing status, or follow-up recommendations may be manipulated by malicious email content.

Why it was flagged

Untrusted email bodies are embedded into an LLM prompt for classification; the skill tries to detect prompt attacks, but the model output can still be influenced by hostile email text.

Skill content

tiene_prompt=true si hay instrucciones IA, jailbreaks, "ignore previous instructions" ... Correos: {json.dumps(correos,ensure_ascii=False)}

Recommendation

Treat analysis output as advisory, isolate email content as untrusted data, and require human confirmation before any downstream organizer or responder action.

ASI07: Insecure Inter-Agent Communication

Medium

What this means

Private email contents may leave Gmail/local storage and be processed by an external AI provider.

Why it was flagged

The analyzer sends email metadata, body snippets, and attachment names to Anthropic for AI analysis.

Skill content

correos=[{"id":e.get("id"),"remitente":e.get("remitente",""),"asunto":e.get("asunto",""),"cuerpo":e.get("cuerpo","")[:1500] ...}] ... client.messages.create(... content=_prompt(batch))

Recommendation

Use the AI analyzer only with explicit user consent, disclose the provider data flow, and redact or avoid highly confidential messages.

ASI06: Memory and Context Poisoning

Low

What this means

Malicious prompt text could remain in the workspace and later be read or summarized as if it were ordinary notes.

Why it was flagged

Detected prompt text from emails is persisted into a markdown file, which may contain hostile instructions copied from messages.

Skill content

PROMPTS_FILE   = "prompts_detectados.md" ... f.write(f"**Prompt:**\n```\n{e.get('prompt_texto',e.get('cuerpo',''))[:500]}\n```\n\n")

Recommendation

Store these logs as clearly labeled untrusted data, avoid auto-loading them into future agent context, and allow easy deletion.

ASI04: Agentic Supply Chain Vulnerabilities

Low

What this means

Installing the skill also means trusting third-party packages and future package updates.

Why it was flagged

The skill depends on an external Homebrew tap and unpinned Python packages; this is expected for the integration but still expands the trusted supply chain.

Skill content

brew install steipete/tap/gogcli ... pip install google-api-python-client google-auth-oauthlib beautifulsoup4 cryptography python-dotenv anthropic

Recommendation

Install from trusted sources, pin dependency versions where possible, and review the gog CLI and Python dependencies before use.