ClawHub
Back to skill

Security audit

Google Admin

Security checks for vulnerabilities and agentic risk

Overview

This Google Workspace admin skill is coherent and disclosed, but it enables a third-party plugin and hosted service to use administrator OAuth access for high-impact directory changes with limited install pinning and scope detail.

Review this before installing in a production Workspace. Use a dedicated least-privilege admin account, verify the ClawLink plugin and service provenance, confirm the OAuth scopes requested during connection, monitor Workspace audit logs, revoke the token if anything looks wrong, and avoid putting real passwords directly into chat or command-line examples.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:53
Finding

Unpinned Third-Party Plugin Installed with Privileged Google Workspace Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53-57
Vulnerability Type: Unpinned and externally hosted privileged dependency
Risk Level: High

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation command references clawhub:clawlink-plugin without an immutable version, package digest, or signature requirement. The subsequent command explicitly authorizes the plugin's tools, and the gateway restart activates the installed component.

Elsewhere, the skill states that ClawLink stores the connected Google Workspace administrator OAuth token and injects it into Google Admin API requests. Consequently, the plugin and its hosted service operate across a sensitive trust boundary. The project does not include the plugin source, a checksum, an immutable release identifier, or an independently enforceable OAuth scope definition. The effective implementation therefore remains outside this artifact's audit boundary and may change after the skill has been reviewed.

This is a supply-chain weakness rather than evidence that the current dependency is malicious. Exploitation requires compromise or malicious modification of the package registry entry, plugin release process, distributed package, or hosted ClawLink service.

Attack Path

  1. An attacker compromises the plugin publisher, package registry entry, release pipeline, distributed package, or associated hosted service.
  2. The user follows the documented command and installs the unversioned plugin, potentially receiving the compromised release.
  3. OpenClaw adds the plugin to the allowed tool list and restarts the gateway, activating the component.
  4. The user connects a Google Workspace administrator account through the documented OAuth workflow.
  5. The compromised component observes delegated ...[truncated 1137 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version rather than installing an unconstrained package reference.
  2. Verify a cryptographic package digest and publisher signature before installation.
  3. Publish or vendor the exact plugin source corresponding to the pinned artifact so its behavior can be audited.
  4. Document every requested Google OAuth scope and remove scopes not strictly required for the requested operation.
  5. Use a dedicated least-privilege delegated administrator account instead of a super-administrator account.
  6. Separate read-only and write-capable integrations, granting write scopes only when needed.
  7. Restrict the local allowlist to individually reviewed tools where the platform supports tool-level controls.
  8. Disable automatic dependency updates or require explicit review, signature verification, and staged testing before upgrades.
  9. Monitor Google Workspace audit logs and OAuth activity for unexpected administrative requests.
  10. Provide token revocation and incident-response instructions for package or hosted-service compromise.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:161
Finding

Account Password Passed Directly in Command-Line Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 161-173
Vulnerability Type: Plaintext sensitive data in command arguments
Risk Level: Medium

Vulnerable Code

bash
clawlink_call_tool --tool "google_admin_create_user" \
  --params '{
    "primary_email": "newuser@example.com",
    "name": {
      "given_name": "New",
      "family_name": "User"
    },
    "password": "secure-password-here"
  }'

Technical Analysis

The documented account-creation workflow places the new user's password directly in the JSON command-line argument. Although the shown value is a placeholder rather than a hardcoded real credential, users are expected to replace it with an actual password when following the example.

Command-line secrets can be exposed through shell history, terminal or chat transcripts, process inspection facilities, diagnostic output, command auditing, telemetry, and wrapper-tool logs. The downstream plugin or hosted service may also log the complete parameter object unless explicit field-level redaction is enforced.

Quoting the JSON prevents ordinary shell expansion but does not protect the password from command-history retention, process metadata, transcript capture, or application logging.

Attack Path

  1. An administrator copies the documented command and replaces secure-password-here with a real initial account password.
  2. The command is executed or submitted through an environment that retains command text or tool parameters.
  3. The password is stored in shell history, an agent transcript, process metadata, telemetry, diagnostics, or plugin/service logs.
  4. A local user, support operator, log reader, compromised monitoring system, or other party with access to the retained data retrieves the password.
  5. The attacker signs in to the newly created account before the password is changed, subject to applicable Workspace sign-in controls.

Impact Assessment

Explo ...[truncated 626 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not place passwords or other secrets directly in command-line arguments.
  2. Accept the password through an interactive no-echo prompt or protected standard input.
  3. Prefer a secret-manager reference or short-lived secret handle when supported by the tool.
  4. Ensure the plugin, agent, proxy, and hosted service apply field-level redaction to password parameters in logs, previews, errors, traces, and transcripts.
  5. Prevent secret values from appearing in process listings, shell history, command auditing, and telemetry.
  6. Generate a unique, cryptographically random temporary password rather than asking administrators to type a reusable credential.
  7. Require the user to change the temporary password at first sign-in and expire unused temporary credentials promptly.
  8. Enable multi-factor authentication and risk-based sign-in controls according to organizational policy.
  9. Update the documentation with a safe secret-input example and an explicit warning against substituting real credentials directly into the displayed command.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.