Google Gog

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:46 AM UTC
• Version: 1.0.0

Overview

This skill is a simple Markdown guide, but it gives broad Google mail and file access instructions that are wider and less safely scoped than its stated token-refresh purpose.

Install only after confirming this is meant for your Google account and that you are comfortable granting Gmail, Drive, and Calendar access. Prefer OS keychain or a managed secret store over the file keyring mode, and replace the hard-coded email and credential path with your own explicit configuration.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

## Configuration

- **Account:** `[e-mail]`
- **Credentials:** `~/.openclaw/credentials/client_secret.json`
- **Token Storage:** OS Keyring (auto-encrypted)

## Refresh Token Lifecycle

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**For automation (cron/headless):**
```bash
export GOG_KEYRING_BACKEND=file
export GOG_KEYRING_PASSWORD=<password>
gog auth list --check  # Check token validity and expiration
```

• Confidence: 96% confidence
• Finding: The documented use of a file-backed keyring for automation materially increases the chance that refresh tokens or related secrets will be stored in a less secure location than the OS keychain. In a skill that manages Google OAuth tokens for Gmail and Drive, compromised token storage can directly enable mailbox access, file access, and persistent API use.

Credential Access

High

• Category: Privilege Escalation

Content

**For automation (cron/headless):**
```bash
export GOG_KEYRING_BACKEND=file
export GOG_KEYRING_PASSWORD=<password>
gog auth list --check  # Check token validity and expiration
```

• Confidence: 98% confidence
• Finding: Exporting GOG_KEYRING_PASSWORD exposes a secret through an environment variable, which may be retrievable by other local processes, diagnostic tooling, CI logs, crash dumps, or shell history. Because this password protects token storage used for Google API access, disclosure can lead to theft of refresh tokens and long-lived access to email, files, and calendars.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Hard-coding a specific personal email account biases the skill toward using one identity without explicit user selection or consent. In practice this can cause accidental use of the wrong account, privacy issues, or unintended access to another person's mail and files if copied into an automated environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The automation guidance instructs users to switch to a file-based keyring backend and export a keyring password in the environment without warning about the security tradeoffs. Environment variables and local files are often exposed through process listings, shell history, logs, backups, or weak filesystem permissions, increasing the chance of OAuth token compromise.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill manifest says it is only for OAuth token refresh management, but the documented commands enable operational Gmail and Drive actions such as sending email and uploading/downloading files. This scope mismatch can mislead users and downstream policy systems, causing broader data access and actions than the declared purpose suggests.

Static analysis

No suspicious patterns detected.