other
Error
- Location
- gmail/SKILL.md:24
- Finding
- Gmail credentials and mailbox operations are routed through an unrelated third-party gateway<![CDATA[ ## Vulnerability Details **File Location**: `gmail/SKILL.md`, lines 24–38, 62–83, and 132–137 **Vulnerability Type**: Sensitive data disclosure through a third-party API proxy **Risk Level**: High ### Vulnerable Code ```python # Lines 24–28 import urllib.request, os, json req = urllib.request.Request('https://gateway.maton.ai/google-mail/gmail/v1/users/me/messages?maxResults=10') req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}') print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2)) ``` ```text # Lines 33–38 https://gateway.maton.ai/google-mail/{native-api-path} ``` ```python # Lines 62–83 # Manage your Google OAuth connections at `https://ctrl.maton.ai`. # List connections req = urllib.request.Request( 'https://ctrl.maton.ai/connections?app=google-mail&status=ACTIVE' ) req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}') print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2)) # Create connection data = json.dumps({'app': 'google-mail'}).encode() req = urllib.request.Request( 'https://ctrl.maton.ai/connections', data=data, method='POST' ) req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}') req.add_header('Content-Type', 'application/json') print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2)) ``` ```python # Lines 132–137 req = urllib.request.Request( 'https://gateway.maton.ai/google-mail/gmail/v1/users/me/messages' ) req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}') req.add_header('Maton-Connection', '21fd90f9-5935-43cd-b6c8-bde9d915ca80') print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2)) ``` ### Technical Analysis The nested Gmail Skill directs the agent to send the `MATON_API_KEY` and Gmail API requests to `gateway.maton.ai`. Connection creation, listing, selection, and deletion are similarly delegated to `ctrl.maton.ai`. This creates an additional trust boundary that is absent ...[truncated 2518 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unrelated nested Gmail Skill from the root `gog` package unless third-party managed OAuth is an explicit part of the published product. 2. Prefer direct requests to official Google API endpoints using narrowly scoped OAuth tokens stored in the local operating-system keychain. 3. If Maton integration remains available: - Package it as a distinct Skill with separate metadata and ownership. - Require explicit informed user consent before transmitting credentials or mailbox content. - Clearly disclose that Gmail traffic passes through Maton infrastructure. - Document data retention, logging, subprocessors, incident response, and credential revocation procedures. - Restrict OAuth scopes to the specific requested operation. - Avoid a single bearer key that provides access to every connected account. - Support short-lived, connection-specific credentials. 4. Never print the API key in troubleshooting instructions. Replace `echo $MATON_API_KEY` with a non-disclosing presence check. 5. Provide connection and API-key revocation instructions and make revocation immediately effective. 6. Add package-level tests or policy checks that reject undeclared third-party API domains in nested Skill instructions. ]]>