ClawHub
Back to skill

Security audit

Recipe Forward Labeled Emails

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it forwards full Gmail message contents externally without built-in confirmation, preview, or clear scoping safeguards.

Before installing or using this recipe, confirm the Gmail label query, destination address, number of matched messages, and exact content to forward. Use it only where forwarding full email bodies is expected and permitted, and avoid broad labels that may include sensitive personal, legal, financial, or customer data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The recipe explicitly retrieves Gmail message contents and forwards them to another address, which causes user email data to be transmitted outside the original mailbox. Even if this is the stated purpose of the skill, the absence of any warning, confirmation step, or scoping guidance increases the risk of accidental disclosure of sensitive or regulated information.

Ssd 3

Medium
Confidence
95% confidence
Finding
The skill creates a direct natural-language exfiltration path by copying full email body content from labeled messages into a newly sent message to another recipient. In context, this is functionality rather than overt malice, but it is still dangerous because labels may match sensitive emails and the recipe provides no safeguards against overbroad forwarding or misdelivery.

Static analysis

No suspicious patterns detected.