ClawHub
Back to skill

Security audit

ClawEmail

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Google Workspace helper, but it gives an agent broad power over email, files, calendars, and documents without strong built-in guardrails.

Install only if you trust ClawEmail and are comfortable connecting the selected Google account. Prefer a dedicated or least-privileged account, protect the credentials and token cache, review OAuth scopes, and require an explicit preview and confirmation before allowing sends, shares, deletes, calendar changes, or bulk edits.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill exposes shell-based operational capability throughout the document but does not declare explicit permissions or guardrails for shell execution. That mismatch increases the chance that an agent can perform sensitive actions such as reading mail, sending mail, modifying files, or deleting content without clear policy enforcement or user awareness.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The proactive trigger is extremely broad and covers nearly any Google-related request, which can cause over-invocation of a highly privileged skill. In context, this is risky because the skill can read private data, send emails, share files, and alter calendars or documents across a user's Google Workspace.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents many destructive and privacy-impacting actions, including reading email, sending email, deleting files, sharing files, and deleting calendar events, but does not provide explicit warnings or consent requirements. In a proactive skill, omission of such warnings makes accidental or unauthorized high-impact actions more likely.

Credential Access

High
Category
Privilege Escalation
Content
Get credentials at https://clawemail.com — sign up, then visit `/connect/YOUR_PREFIX` to authorize OAuth.

## Getting an Access Token

All API calls need a Bearer token. Use the helper script to refresh and cache it:
Confidence
89% confidence
Finding
Access Token

Credential Access

High
Category
Privilege Escalation
Content
#!/usr/bin/env bash
# Refresh and output a Google OAuth access token from ClawEmail credentials.
# Usage: token.sh [credentials-file]
# Caches token for 50 minutes (access tokens last 60 min).
set -euo pipefail

CREDS_FILE="${1:-${CLAWEMAIL_CREDENTIALS:-$HOME/.config/clawemail/credentials.json}}"
Confidence
88% confidence
Finding
access tokens

Credential Access

High
Category
Privilege Escalation
Content
ACCESS_TOKEN=$(echo "$RESPONSE" | python3 -c "import json,sys;print(json.load(sys.stdin)['access_token'])")

if [[ -z "$ACCESS_TOKEN" || "$ACCESS_TOKEN" == "None" ]]; then
    echo "ERROR: Failed to refresh access token" >&2
    echo "$RESPONSE" >&2
    exit 1
fi
Confidence
91% confidence
Finding
access token

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: claw
description: "Google Workspace via ClawEmail — Gmail, Drive, Docs, Sheets, Slides, Calendar, Forms. Use PROACTIVELY when the user asks to send email, create documents, manage files, schedule events, or work with any Google service."
metadata: {"openclaw":{"emoji":"🦞","requires":{"env":["CLAWEMAIL_CREDENTIALS"]},"primaryEnv":"CLAWEMAIL_CREDENTIALS"}}
---
Confidence
80% confidence
Finding
create documents, manage files, schedule events, or work with any Google service." metadata: {"openclaw":{"emoji":"🦞","requires":{"env":["CLAWEMAIL_CREDENTIALS"]},"primaryEnv":"CLAWEMAIL_CREDENTIALS"}

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.