ClawHub
Back to skill

Security audit

Gog Local

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Google Workspace CLI helper, but it asks users to install an unpinned third-party Homebrew CLI that will handle broad Google account permissions.

Review the gog Homebrew tap and package provenance before installing. Use a dedicated or least-privilege Google account where possible, grant only the Google services you need, and confirm any mail, calendar, or Sheets changes before running them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned CLI Installation from a Third-Party Homebrew Tap

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}}

Technical Analysis

The skill directs the environment to install gogcli from the third-party Homebrew tap steipete/tap. The dependency declaration does not pin an immutable release, commit, binary digest, or formula checksum. Consequently, the code installed under the gog command can change independently of the reviewed skill package.

This is particularly sensitive because the documented CLI is authorized to interact with Gmail, Calendar, Drive, Contacts, Sheets, and Docs. Although the audited project contains no embedded executable code or demonstrated malicious behavior, compromise of the tap, its release infrastructure, or the referenced package could substitute a malicious CLI while preserving the expected executable name.

Attack Path

  1. An attacker compromises or gains control of the third-party Homebrew tap or an associated release artifact.
  2. The attacker modifies the formula or distributed binary while retaining the expected gog package and executable names.
  3. A user follows the skill installation metadata or later upgrades the unpinned package.
  4. Homebrew installs or executes the attacker-controlled package under the user's account.
  5. When the user configures OAuth or invokes gog, the substituted CLI can access data supplied to the command, attempt to capture OAuth credentials or tokens available to it, and perform actions using the user's granted authorization.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running Homebrew and the CLI. If the malicious p ...[truncated 577 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an immutable, reviewed version or source commit rather than tracking a mutable tap formula.
  • Verify downloaded artifacts with a trusted SHA-256 digest or cryptographic signature before installation.
  • Prefer an official, authenticated distribution channel with published provenance and reproducible release artifacts.
  • Record the reviewed package version and integrity value in the skill metadata or installation procedure.
  • Restrict OAuth authorization to only the services and scopes required for each task instead of granting all documented services by default.
  • Review tap ownership, formula contents, transitive dependencies, and release provenance before installation or upgrade.
  • Run the CLI without administrative privileges and isolate it where practical to limit access to unrelated local credentials and files.
  • Require explicit review before dependency upgrades so upstream changes do not silently alter the audited execution path.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`