Morning Brief

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.1

Overview

The published skill describes a daily morning brief, but it also ships an executable Gmail inbox reader that is not disclosed in the skill instructions.

Review before installing. Only use this skill if you explicitly want it to have Gmail IMAP access, understand that an app password can be sensitive, and are comfortable with private sender and subject metadata being printed. The publisher should either remove the email helper or clearly document opt-in Gmail access and limit retrieval to the minimum needed headers.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: email_briefing.py:10

Finding

Undeclared and Excessive Gmail Inbox Access

Content

View full analysis

Vulnerability Details

File Location: email_briefing.py, lines 10–11, 21–23, and 31–33
Vulnerability Type: Least-privilege violation through undeclared Gmail access
Risk Level: High

Relevant code:

python

# Credentials from environment
EMAIL = os.environ.get("GMAIL_EMAIL", "")  # Set in ~/.openclaw/.env
APP_PASSWORD = os.environ.get("GMAIL_APP_PASSWORD", "")

python

# Connect
ctx = ssl.create_default_context()
mail = imaplib.IMAP4_SSL(IMAP_SERVER, IMAP_PORT, ssl_context=ctx)
mail.login(EMAIL, APP_PASSWORD)
mail.select("INBOX")

python

for uid in mail_ids[-20:]:  # last 20
    status, msg_data = mail.fetch(uid, "(RFC822)")
    msg = emaillib.message_from_bytes(msg_data[0][1])

Technical Analysis

SKILL.md declares a daily briefing covering weather, healthcare revenue-cycle news, Pittsburgh sports, and fantasy baseball. It does not declare email triage, Gmail authentication, or inbox processing. Nevertheless, email_briefing.py obtains Gmail credentials from the process environment, authenticates to Gmail, selects the inbox, and retrieves up to 20 unread messages.

The RFC822 fetch operation downloads complete messages, potentially including bodies and attachments. This exceeds the script's actual processing requirement because it only uses the Subject, From, and Date headers for classification and display. The implementation therefore violates least privilege both at the feature level—email access is outside the documented Skill purpose—and at the data level—complete messages are retrieved when selected headers would suffice.

The referenced ~/.openclaw/.env path appears only in a comment. The code does not directly open, enumerate, or modify that file. Credentials are sent to imap.gmail.com over TLS using Python's certificate-validating default SSL context, and no attacker-controlled exfiltration endpoint was identified.

Attack Path

1. The Skil ...[truncated 1409 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove email_briefing.py if email triage is not an intended part of the Morning Brief Skill.
2. If email triage is required, document it explicitly in SKILL.md, including the accessed account, data categories, processing behavior, output destination, and retention risks, and require informed opt-in before requesting credentials.
3. Use a dedicated account or a narrowly scoped, revocable authorization mechanism where possible instead of an account-wide Gmail app password.
4. Retrieve only the required headers rather than complete messages. For example, use an IMAP operation equivalent to:

   python

   mail.fetch(
       uid,
       "(BODY.PEEK[HEADER.FIELDS (SUBJECT FROM DATE)])"
   )
   

5. Avoid printing sensitive sender and subject metadata to persistent or shared logs. Send the minimum necessary briefing through an explicitly approved private destination.
6. Validate both GMAIL_EMAIL and GMAIL_APP_PASSWORD before attempting authentication, and fail without exposing credential values.
7. Add robust checks for IMAP search and fetch statuses, malformed responses, and guaranteed logout through try/finally or a context manager.
8. Keep credentials in an approved secret manager or protected runtime injection mechanism, with restricted access, rotation, and revocation procedures.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · email_briefing.py (reported line 10)May include surrounding context.

python

from datetime import datetime, timedelta, date

# Credentials from environment
EMAIL = os.environ.get("GMAIL_EMAIL", "")  # Set in ~/.openclaw/.env
APP_PASSWORD = os.environ.get("GMAIL_APP_PASSWORD", "")
IMAP_SERVER = "imap.gmail.com"
IMAP_PORT = 993

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

---

## Files
- `/workspace/skills/morning-brief/SKILL.md` (this)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill pulls Gmail address and app password from environment variables and uses them to authenticate to a third-party mailbox without prominently disclosing that sensitive account credentials are required. In a reusable agent-skill ecosystem, undisclosed credential use increases the risk of users supplying high-value secrets without understanding the access granted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script connects to Gmail and fetches full RFC822 messages from the user's inbox without any explicit user-facing notice, consent flow, or minimization of accessed data. In an agent skill context, this is dangerous because it silently reads potentially sensitive personal or business email content when the user may expect only lightweight metadata access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level documentation states a specific behavior: producing an inbox summary in 3 bullets. In practice, the script enumerates all urgent and medium messages and up to five can-wait items, so the output can substantially exceed three bullets and is more of a categorized listing than a 3-bullet summary.

Content

No source excerpt is available for this finding.