ClawHub
Back to skill

Security audit

Google Chat

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate Google Chat sender, but it needs review because it stores OAuth tokens plainly, requests broad Chat permissions, and accepts unrestricted webhook URLs.

Install only if you are comfortable granting Google Chat message, space, and membership-read access to this script. Keep webhook URLs, OAuth client files, and token JSON files out of source control and shared folders, restrict their file permissions, and avoid sending secrets or sensitive internal content unless the destination is explicitly approved. Prefer a reviewed config with Google Chat webhook URLs only.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_webhook.py:16
Finding

Unrestricted Webhook Destination Permits Message Exfiltration and Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_oauth.py:38
Finding

OAuth Credentials Are Persisted Without Explicit Restrictive File Protections

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/send_oauth.py:27
Finding

OAuth Authorization Is Not Partitioned According to the Selected Operation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:108
Finding

Documentation Installs Mutable Unpinned Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The top-level description overstates support for OAuth, dynamic space/user messaging, and direct messaging, but the documentation does not consistently demonstrate those features as actually implemented. Security reviews depend on accurate capability disclosure, and inflated claims obscure what network actions and data access the skill really performs.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The top-level description overstates support for OAuth, dynamic space/user messaging, and direct messaging, but the documentation does not consistently demonstrate those features as actually implemented. Security reviews depend on accurate capability disclosure, and inflated claims obscure what network actions and data access the skill really performs.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
---
name: google-chat
description: Send messages to Google Chat spaces and users via webhooks or OAuth. Use when you need to send notifications, alerts, or messages to Google Chat channels (spaces) or direct messages to specific users. Supports both incoming webhooks (for predefined channels) and OAuth 2.0 (for dynamic messaging to any space or user).
---

# Google Chat Messaging

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: google-chat
description: Send messages to Google Chat spaces and users via webhooks or OAuth. Use when you need to send notifications, alerts, or messages to Google Chat channels (spaces) or direct messages to specific users. Supports both incoming webhooks (for predefined channels) and OAuth 2.0 (for dynamic messaging to any space or user).
---

# Google Chat Messaging

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
---
name: google-chat
description: Send messages to Google Chat spaces and users via webhooks or OAuth. Use when you need to send notifications, alerts, or messages to Google Chat channels (spaces) or direct messages to specific users. Supports both incoming webhooks (for predefined channels) and OAuth 2.0 (for dynamic messaging to any space or user).
---

# Google Chat Messaging

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config-example.json (reported line 8)May include surrounding context.

json
"alerts": "https://chat.googleapis.com/v1/spaces/..."
  },
  "oauth": {
    "credentials_path": "./google-chat-oauth-credentials.json",
    "token_path": "./google-chat-token.json"
  }
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The OAuth examples instruct users to use oauth-creds.json and token.json without noting that these files contain sensitive authentication material. If stored insecurely, committed to source control, or shared in logs or tickets, they could allow unauthorized access to Google Chat resources under the authenticated account or app.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents network access and local file writes for webhook configuration, OAuth credential storage, and token persistence, but it declares no explicit tool scope or permissions. This weakens least-privilege controls and makes it easier for an agent to invoke outbound messaging or write sensitive credential material without clear policy boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages sending messages to external Google Chat services but does not prominently warn that message bodies, space identifiers, webhook URLs, OAuth credentials, and tokens are sensitive. Without that warning, users may paste secrets or internal data into examples and mishandle credentials, creating preventable exfiltration risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation contradicts itself by stating elsewhere that DMs cannot be created by email while later providing a --dm email example. Inconsistent instructions around recipient targeting can lead users to send messages to unintended destinations, misunderstand API guarantees, or build workflows that fail in unsafe ways.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring's usage example advertises --dm user@domain.com as a supported way to send a DM. However, create_dm_space later states that OAuth cannot create DMs by email and always returns None, causing the --dm path to fail. This is an active contradiction between the documented intent and actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README advertises listing spaces and DMs but does not warn that this capability exposes workspace structure, channel names, and direct-message metadata that may be sensitive in some environments. While discovery is a legitimate feature of the Google Chat API, documenting it without any caution increases the risk of unnecessary metadata enumeration and casual misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.