ClawHub
Back to skill

Security audit

GOG Extended

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Google Workspace CLI skill, but it exposes real personal/transactional example data and under-scopes sensitive email and account-changing operations.

Review this skill before installing. Use it only with Google accounts and services you are authorized to access, avoid broad OAuth scopes when a narrower setup is enough, and require explicit confirmation before sending email, downloading attachments, changing calendars, or modifying/clearing Sheets. Treat the included real-looking email/order examples as a publication privacy issue and do not reuse them in your own workflows.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/email-extraction-patterns.md:9
Finding

Personal and Transactional Information Exposed in Published Examples

Content
View full analysis
", "subject": "Your gear is on its way! [c177467696945199]" } ``` ### Technical Analysis The published reference embeds apparently real personal email addresses, an institutional affiliation, a Gmail message identifier, retailer and purchase details, a purchase amount, and an order-related identifier. Documentation examples should use fictional, non-routable identities and synthetic records rather than data copied from an actual mailbox. These values do not constitute authentication credentials and do not independently permit access to Gmail. Nevertheless, they disclose correlated personal and transactional metadata that can be collected without authorization. Combining the personal address, institutional address, retailer, product, price, shipment subject, and identifiers may allow an attacker to ...[truncated 1617 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Setup (one-time)

bash
gog auth credentials /path/to/client_secret.json
gog auth add you@gmail.com --services gmail,calendar,drive,contacts,docs,sheets
gog auth list

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly promotes retrieving full email bodies, headers, and attachment identifiers for automation, but provides no safety guidance about sensitive-content handling, minimization, or consent. In an agent context, this increases the risk of unnecessary exposure of private communications, secrets, invoices, personal data, or tokens embedded in emails and attachments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill includes outbound and state-changing commands such as sending email, creating drafts, updating calendars, and modifying sheets, but does not warn that these actions affect external systems or may send communications on the user's behalf. In an automated agent setting, this can lead to unintended data modification, reputational harm, or accidental external disclosure if commands are executed without clear confirmation boundaries.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Documenting --force and --no-input is not inherently malicious, but in a skill aimed at automation these flags reduce human oversight and enable fully autonomous execution of sensitive operations. Combined with email sending and document/calendar modification features, this can bypass confirmation safeguards and increase the chance of unintended or high-impact actions.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md
- `--json` — Output JSON (best for scripting)
- `--plain` — Stable TSV format (no colors)
- `--dry-run` — Preview changes without executing
- `--force` — Skip confirmations
- `--no-input` — Never prompt (useful for CI/automation)
- `--verbose` — Enable verbose logging

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file provides commands to retrieve full email bodies and download attachments, which can expose personal, financial, or other sensitive data. The examples describe how to perform these actions but do not warn users about privacy implications, safe storage, or reviewing message contents before extraction.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/email-extraction-patterns.md (reported line 130)May include surrounding context.

md
- Always use `--account` when multiple accounts are configured
- Use `--json` for programmatic parsing
- Use `--no-input` to skip confirmations in scripts
- Use `gog gmail get --format=full` for complete email body (don't rely on search metadata)
- Test grep/sed patterns on sample emails first before automating

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The file demonstrates searching across multiple Gmail accounts, including a personal and a Berkeley account, but does not caution users about privacy boundaries or organizational policies when accessing multiple mailboxes. For a skill description that can affect user data visibility, a brief disclosure is expected.

Content

No source excerpt is available for this finding.