Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Markdown guide, but it gives broad Google mail and file access instructions that are wider and less safely scoped than its stated token-refresh purpose.
Install only after confirming this is meant for your Google account and that you are comfortable granting Gmail, Drive, and Calendar access. Prefer OS keychain or a managed secret store over the file keyring mode, and replace the hard-coded email and credential path with your own explicit configuration.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Configuration
- **Account:** `xtyherry@gmail.com`
- **Credentials:** `~/.openclaw/credentials/client_secret.json`
- **Token Storage:** OS Keyring (auto-encrypted)
## Refresh Token Lifecycle
The documented use of a file-backed keyring for automation materially increases the chance that refresh tokens or related secrets will be stored in a less secure location than the OS keychain. In a skill that manages Google OAuth tokens for Gmail and Drive, compromised token storage can directly enable mailbox access, file access, and persistent API use.
For automation (cron/headless):
export GOG_KEYRING_BACKEND=file
export GOG_KEYRING_PASSWORD=<password>
gog auth list --check # Check token validity and expiration
Exporting GOG_KEYRING_PASSWORD exposes a secret through an environment variable, which may be retrievable by other local processes, diagnostic tooling, CI logs, crash dumps, or shell history. Because this password protects token storage used for Google API access, disclosure can lead to theft of refresh tokens and long-lived access to email, files, and calendars.
For automation (cron/headless):
export GOG_KEYRING_BACKEND=file
export GOG_KEYRING_PASSWORD=<password>
gog auth list --check # Check token validity and expiration
Hard-coding a specific personal email account biases the skill toward using one identity without explicit user selection or consent. In practice this can cause accidental use of the wrong account, privacy issues, or unintended access to another person's mail and files if copied into an automated environment.
The automation guidance instructs users to switch to a file-based keyring backend and export a keyring password in the environment without warning about the security tradeoffs. Environment variables and local files are often exposed through process listings, shell history, logs, backups, or weak filesystem permissions, increasing the chance of OAuth token compromise.
The skill manifest says it is only for OAuth token refresh management, but the documented commands enable operational Gmail and Drive actions such as sending email and uploading/downloading files. This scope mismatch can mislead users and downstream policy systems, causing broader data access and actions than the declared purpose suggests.
No suspicious patterns detected.