GOG Extended

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 2.1.0

Overview

This is a documentation-only Google Workspace CLI skill, but it exposes real personal/transactional example data and under-scopes sensitive email and account-changing operations.

Review this skill before installing. Use it only with Google accounts and services you are authorized to access, avoid broad OAuth scopes when a narrower setup is enough, and require explicit confirmation before sending email, downloading attachments, changing calendars, or modifying/clearing Sheets. Treat the included real-looking email/order examples as a publication privacy issue and do not reuse them in your own workflows.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/email-extraction-patterns.md:9
• Finding: Personal and Transactional Information Exposed in Published Examples<![CDATA[ ## Vulnerability Details **File Location**: `references/email-extraction-patterns.md:9-12, 19-25, 62-68, 119-124` **Vulnerability Type**: Plaintext exposure of personal and transactional information **Risk Level**: Medium ### Vulnerable Code Snippets `references/email-extraction-patterns.md:9-12` ```bash # 1. Find order confirmation gog gmail messages search 'from:[e-mail] subject:"We got your order"' --max 1 --account [e-mail] # 2. Extract message ID from results ``` `references/email-extraction-patterns.md:19-25` ```bash $ gog gmail get 19d33029153e8b10 --format=full --account [e-mail] | grep -i "item\|product\|cap" Structured Classic Ball Cap *Golf L 1 x Subtotal (1 item) $44.00 ``` `references/email-extraction-patterns.md:62-68` ```bash # List all accounts gog auth list # Search personal Gmail gog gmail search 'newer_than:7d' --max 10 --account [e-mail] # Search Berkeley account gog gmail search 'newer_than:7d' --max 10 --account [e-mail] ``` `references/email-extraction-patterns.md:119-124` ```json { "date": "2026-03-29 21:13", "from": "lululemon <[e-mail]>", "subject": "Your gear is on its way! [c177467696945199]" } ``` ### Technical Analysis The published reference embeds apparently real personal email addresses, an institutional affiliation, a Gmail message identifier, retailer and purchase details, a purchase amount, and an order-related identifier. Documentation examples should use fictional, non-routable identities and synthetic records rather than data copied from an actual mailbox. These values do not constitute authentication credentials and do not independently permit access to Gmail. Nevertheless, they disclose correlated personal and transactional metadata that can be collected without authorization. Combining the personal address, institutional address, retailer, product, price, shipment subject, and identifiers may allow an attacker to ...[truncated 1617 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all personal email addresses with reserved examples such as `[e-mail]` and `[e-mail]`. 2. Replace the Gmail message ID, order identifier, dates, product details, quantities, and prices with clearly synthetic values. 3. Avoid naming a real retailer when demonstrating workflows unless the example contains no personal transaction data. 4. Review the repository history, package registry versions, release archives, and documentation mirrors for the same exposed information. 5. If the data was publicly distributed, notify the affected individual and assess whether the exposed identifiers should be treated as compromised. 6. Add a publication review rule that rejects: - Personal or institutional email addresses - Real message, thread, attachment, invoice, or order identifiers - Transaction records copied from actual accounts - API credentials, access tokens, or client-secret files 7. Use a standardized synthetic fixture for all future Gmail examples, for example: ```bash gog gmail get 0123456789abcdef --format=full --account [e-mail] ``` 8. Consider automated secret and personal-data scanning in CI before publishing new Skill versions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

## Setup (one-time)

```bash
gog auth credentials /path/to/client_secret.json
gog auth add [e-mail] --services gmail,calendar,drive,contacts,docs,sheets
gog auth list
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly promotes retrieving full email bodies, headers, and attachment identifiers for automation, but provides no safety guidance about sensitive-content handling, minimization, or consent. In an agent context, this increases the risk of unnecessary exposure of private communications, secrets, invoices, personal data, or tokens embedded in emails and attachments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill includes outbound and state-changing commands such as sending email, creating drafts, updating calendars, and modifying sheets, but does not warn that these actions affect external systems or may send communications on the user's behalf. In an automated agent setting, this can lead to unintended data modification, reputational harm, or accidental external disclosure if commands are executed without clear confirmation boundaries.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- `--json` — Output JSON (best for scripting)
- `--plain` — Stable TSV format (no colors)
- `--dry-run` — Preview changes without executing
- `--force` — Skip confirmations
- `--no-input` — Never prompt (useful for CI/automation)
- `--verbose` — Enable verbose logging

• Confidence: 85% confidence
• Finding: Documenting `--force` and `--no-input` is not inherently malicious, but in a skill aimed at automation these flags reduce human oversight and enable fully autonomous execution of sensitive operations. Combined with email sending and document/calendar modification features, this can bypass confirmation safeguards and increase the chance of unintended or high-impact actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file provides commands to retrieve full email bodies and download attachments, which can expose personal, financial, or other sensitive data. The examples describe how to perform these actions but do not warn users about privacy implications, safe storage, or reviewing message contents before extraction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Always use `--account` when multiple accounts are configured
- Use `--json` for programmatic parsing
- Use `--no-input` to skip confirmations in scripts
- Use `gog gmail get --format=full` for complete email body (don't rely on search metadata)
- Test grep/sed patterns on sample emails first before automating

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The file demonstrates searching across multiple Gmail accounts, including a personal and a Berkeley account, but does not caution users about privacy boundaries or organizational policies when accessing multiple mailboxes. For a skill description that can affect user data visibility, a brief disclosure is expected.

Static analysis

No suspicious patterns detected.