ClawHub
Back to skill

Security audit

Clawemail

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Google Workspace helper, but it gives an agent broad email, file, document, calendar, and forms authority with weak built-in guardrails.

Install only if you trust ClawEmail.com and the publisher with broad Google Workspace access. Use a dedicated or least-privilege Google account where possible, protect the credentials file and token cache, and require manual review before the agent sends email, replies, shares files, exports private content, edits documents, clears sheets, or deletes files/events.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes shell commands extensively (`curl`, `python3`, subshell token assignment) but does not declare corresponding permissions or clearly constrain execution. This creates a trust and review gap: an agent may gain networked shell capability and perform sensitive actions without an explicit permission boundary visible to users or policy systems.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The description presents the skill as a general Google Workspace helper, but the implementation also refreshes OAuth tokens, reads credential material from local disk, and exposes raw bearer tokens to the shell environment. That mismatch hides security-sensitive behavior from users and reviewers, increasing the chance of secret exposure or unauthorized API use.

Vague Triggers

High
Confidence
95% confidence
Finding
The skill instructs proactive use for broadly phrased requests like managing files or working with any Google service, which overlaps many common tasks. In an agent setting, this can trigger the skill without sufficiently specific user intent, leading to unintended access to email, documents, calendars, or other private data and actions.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documents numerous destructive and privacy-impacting operations—sending email, reading mail, sharing files, deleting files, reading documents, and modifying calendars—without warning language or confirmation guidance. In a high-privilege workspace context, lack of user warnings makes accidental data disclosure or destructive actions materially more likely.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script writes the OAuth access token to a predictable cache file on disk without setting restrictive permissions or warning the user. On multi-user systems or in permissive umask configurations, other local processes or users may be able to read the cached bearer token and use it to access the victim's Google resources until it expires.

External Transmission

Medium
Category
Data Exfiltration
Content
b'To: recipient@example.com\r\nSubject: Hello\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nMessage body here'
).decode()
print(json.dumps({'raw': raw}))
" | curl -s -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d @- \
Confidence
88% confidence
Finding
curl -s -X POST \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
b'To: recipient@example.com\r\nSubject: Re: Original Subject\r\nIn-Reply-To: <original-message-id>\r\nReferences: <original-message-id>\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nReply body'
).decode()
print(json.dumps({'raw': raw, 'threadId': 'THREAD_ID'}))
" | curl -s -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d @- \
Confidence
88% confidence
Finding
curl -s -X POST \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d

Credential Access

High
Category
Privilege Escalation
Content
Get credentials at https://clawemail.com — sign up, then visit `/connect/YOUR_PREFIX` to authorize OAuth.

## Getting an Access Token

All API calls need a Bearer token. Use the helper script to refresh and cache it:
Confidence
97% confidence
Finding
Access Token

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.