Security audit

Tmp

Security checks for vulnerabilities and agentic risk

Overview

The main CLI skill is understandable, but the package also includes separate Gmail gateway instructions and email-tracking code that expose sensitive mail data beyond the root disclosure.

Review before installing. Use this only if you trust the `gog` CLI and understand that bundled materials include broader Google account authority than the root description. Avoid the Maton nested Gmail gateway unless you explicitly intend to send Gmail traffic and a Maton API key through that service. Limit OAuth scopes, prefer read-only where possible, use the command allowlist for agent runs, and avoid email tracking unless you have a clear consent and privacy basis.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

Location: gmail/SKILL.md:24
Finding: Gmail credentials and mailbox operations are routed through an unrelated third-party gateway
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: gmail/gogcli/internal/tracking/worker/src/index.ts:90
Finding: Unauthenticated tracking-query endpoint exposes recipient and email-open metadata
Content: View full analysis
{ const blob = path.slice(3); // Remove '/q/' const key = await importKey(env.TRACKING_KEY); let payload: PixelPayload; try { payload = await decrypt(blob, key); } catch { return new Response('Invalid tracking ID', { status: 400 }); } const result = await env.DB.prepare(` SELECT opened_at, ip, city, region, country, timezone, is_bot, bot_type FROM opens WHERE tracking_id = ? ORDER BY opened_at ASC `).bind( blob ).all(); const opens = result.results.map((row: any) => ({ at: row.opened_at, is_bot: row.is_bot === 1, bot_type: row.bot_type, location: row.city ? { city: row.city, region: row.region, country: row.country, timezone: row.timezone, } : null, })); const humanOpens = opens.filter((o: any) => !o.is_bot); return Response.json({ tracking_id: blob, recipient: payload.r, sent_at: new Date(payload.t * 1000).toISOString(), opens, total_opens: opens.length, human_opens: humanOpens.length, first_human_open: humanOpens[0] || null, }); } ``` The tracking-pixel handler records sensitive request metadata: ```typescript // Lines 40–88 async function handlePixel(request: Re ...[truncated 4341 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (822)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill is a Google Workspace CLI for multiple Google services. The supplied code does not implement any CLI behavior or any interaction with Google Workspace resources. Instead, it is a small browser-side script for a docs site that reads text from a DOM element and re-renders it incrementally as an animated typing effect. This is materially different from the declared primary purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description lists support for Gmail, Calendar, Drive, Contacts, Sheets, and Docs, but this code chunk is specifically for Google Apps Script operations via the Script API. It can read script project metadata and content, execute script functions, and create new Apps Script projects. Apps Script is not mentioned in the declared purpose, and executing/creating script projects is a materially distinct capability from the listed Workspace services. Therefore the description does not accurately represent this code chunk's behavior.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup. Setup (once) - `gog auth credentials /path/to/client_secret.json` - `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs` - `gog auth list`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/index.html (reported line 106)May include surrounding context.
html
Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup. Setup (once) - `gog auth credentials /path/to/client_secret.json` - `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs` - `gog auth list`

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · gmail/gogcli/README.md (reported line 4)May include surrounding context.
md
# 🧭 gogcli — Google in your terminal. ![GitHub Repo Banner](https://ghrb.waren.build/banner?header=gogcli%F0%9F%A7%AD&subheader=Google+in+your+terminal&bg=f3f4f6&color=1f2937&support=true)  Fast, script-friendly CLI for Gmail, Calendar, Chat, Classroom, Drive, Docs, Slides, Sheets, Forms, Apps Script, Contacts, Tasks, People, Groups (Workspace), and Keep (Workspace-only). JSON-first output, multiple accounts, and least-privilege auth built in.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/CHANGELOG.md (reported line 350)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/README.md (reported line 157)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/README.md (reported line 196)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/auth-clients.md (reported line 8)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 76)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 80)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 81)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 129)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 160)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 162)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 329)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 331)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/docs/spec.md (reported line 435)May include surrounding context.
md
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/internal/cmd/auth.go (reported line 74)May include surrounding context.
go
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/internal/cmd/auth.go (reported line 670)May include surrounding context.
go
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/internal/cmd/auth_validation_more_test.go (reported line 28)May include surrounding context.
go
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/internal/cmd/execute_auth_credentials_test.go (reported line 90)May include surrounding context.
go
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/internal/cmd/exit_codes_test.go (reported line 35)May include surrounding context.
go
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/internal/config/clients.go (reported line 213)May include surrounding context.
go
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gmail/gogcli/internal/config/clients_test.go (reported line 235)May include surrounding context.
go
## How it works - Default client name: `default` - Default credentials file: `$(os.UserConfigDir())/gogcli/credentials.json` - Named credentials files: `$(os.UserConfigDir())/gogcli/credentials-<client>.json` - Tokens are stored per client (`token:<client>:<email>`). Default client also writes legacy keys for backwards compatibility. - Default account is stored per client, with a legacy global fallback for the default client.

Static analysis

Detected: suspicious.exposed_resource_identifier, suspicious.exposed_secret_literal

Example code exposes a concrete connection_id instead of a placeholder.

Critical

Code: suspicious.exposed_resource_identifier
Location: gmail/SKILL.md:103

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: gmail/gogcli/internal/config/credentials.go:39

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: gmail/gogcli/internal/googleauth/accounts_server.go:253

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: gmail/gogcli/internal/googleauth/oauth_flow_manual.go:24

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: gmail/gogcli/internal/googleauth/oauth_flow.go:126

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: gmail/gogcli/internal/googleauth/token_check.go:24

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: gmail/gogcli/internal/googleauth/token_email.go:30