Security audit
Security checks for vulnerabilities and agentic risk
Briefed is a disclosed local newsletter reader that uses read-only Gmail access and local persistence in ways that fit its stated purpose.
Install only if you are comfortable granting read-only Gmail access, sending newsletter subjects/senders/snippets to your configured model provider, and storing newsletter bodies plus notes/votes unencrypted in the OpenClaw workspace. Enable the daily cron job or macOS auto-start only when you want ongoing background operation, keep remote reader access token-protected over HTTPS/Tailscale, and revoke Google access plus delete the workspace files when uninstalling.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
launchctl unload ~/Library/LaunchAgents/ai.openclaw.briefed.plist
rm ~/Library/LaunchAgents/ai.openclaw.briefed.plist
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
3. **Delete local data:**
```bash
rm -rf ~/.openclaw/workspace/briefed
rm -f ~/.openclaw/workspace/{briefed-gmail-token.json,newsletter-inbox.json,newsletter-today.json,newsletter-interests.json,newsletter-notes.json,newsletter-filter-rules.json,newsletter-filter-skips.jsonl,reading-list.md}
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
3. **Delete local data:**
```bash
rm -rf ~/.openclaw/workspace/briefed
rm -f ~/.openclaw/workspace/{briefed-gmail-token.json,newsletter-inbox.json,newsletter-today.json,newsletter-interests.json,newsletter-notes.json,newsletter-filter-rules.json,newsletter-filter-skips.jsonl,reading-list.md}
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.openclaw/workspace/briefed
rm -f ~/.openclaw/workspace/{briefed-gmail-token.json,newsletter-inbox.json,newsletter-today.json,newsletter-interests.json,newsletter-notes.json,newsletter-filter-rules.json,newsletter-filter-skips.jsonl,reading-list.md}
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
// Toggle vote off if same, otherwise switch
if (prevVote === action) {
delete state.votes[storyId];
} else {
state.votes[storyId] = action;
}
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
// Toggle vote off if same, otherwise switch
if (prevVote === action) {
delete state.votes[storyId];
} else {
state.votes[storyId] = action;
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from googleapiclient.discovery import build
TOKEN_FILE = os.environ.get('BRIEFED_GMAIL_TOKEN_FILE', os.path.expanduser('~/.openclaw/workspace/briefed-gmail-token.json'))
CLIENT_SECRET_FILE = os.environ.get('BRIEFED_GMAIL_CLIENT_SECRET', os.path.expanduser('~/client_secret.json'))
# Read-only: Briefed never sends, deletes, or modifies mail.
SCOPES = ['https://www.googleapis.com/auth/gmail.readonly']
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from googleapiclient.discovery import build
TOKEN_FILE = os.environ.get('BRIEFED_GMAIL_TOKEN_FILE', os.path.expanduser('~/.openclaw/workspace/briefed-gmail-token.json'))
CLIENT_SECRET_FILE = os.environ.get('BRIEFED_GMAIL_CLIENT_SECRET', os.path.expanduser('~/client_secret.json'))
# Read-only: Briefed never sends, deletes, or modifies mail.
SCOPES = ['https://www.googleapis.com/auth/gmail.readonly']
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
]:
patterns = bundled.get(key, default) + user.get(key, [])
rules[key] = list(dict.fromkeys(p.lower() for p in patterns))
return rules
def is_transactional(subject, sender, rules):
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
2. Authorise Gmail (read-only) via a one-time browser OAuth flow
3. Configure your interest topics
4. Start the reader
5. Create a daily 7am cron job in OpenClaw
Full instructions in `SKILL.md`.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Only needed if you want the reader running permanently. Otherwise run node ~/.openclaw/workspace/briefed/server.js when you want it.
Create ~/Library/LaunchAgents/ai.openclaw.briefed.plist, replacing YOUR_USER and the node path (which node):
<?xml version="1.0" encoding="UTF-8"?>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Only needed if you want the reader running permanently. Otherwise run node ~/.openclaw/workspace/briefed/server.js when you want it.
Create ~/Library/LaunchAgents/ai.openclaw.briefed.plist, replacing YOUR_USER and the node path (which node):
<?xml version="1.0" encoding="UTF-8"?>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Only needed if you want the reader running permanently. Otherwise run node ~/.openclaw/workspace/briefed/server.js when you want it.
Create ~/Library/LaunchAgents/ai.openclaw.briefed.plist, replacing YOUR_USER and the node path (which node):
<?xml version="1.0" encoding="UTF-8"?>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Only needed if you want the reader running permanently. Otherwise run node ~/.openclaw/workspace/briefed/server.js when you want it.
Create ~/Library/LaunchAgents/ai.openclaw.briefed.plist, replacing YOUR_USER and the node path (which node):
<?xml version="1.0" encoding="UTF-8"?>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Only needed if you want the reader running permanently. Otherwise run node ~/.openclaw/workspace/briefed/server.js when you want it.
Create ~/Library/LaunchAgents/ai.openclaw.briefed.plist, replacing YOUR_USER and the node path (which node):
<?xml version="1.0" encoding="UTF-8"?>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Only needed if you want the reader running permanently. Otherwise run node ~/.openclaw/workspace/briefed/server.js when you want it.
Create ~/Library/LaunchAgents/ai.openclaw.briefed.plist, replacing YOUR_USER and the node path (which node):
<?xml version="1.0" encoding="UTF-8"?>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Only needed if you want the reader running permanently. Otherwise run node ~/.openclaw/workspace/briefed/server.js when you want it.
Create ~/Library/LaunchAgents/ai.openclaw.briefed.plist, replacing YOUR_USER and the node path (which node):
<?xml version="1.0" encoding="UTF-8"?>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
<key>Label</key><string>ai.openclaw.briefed</string>
<key>ProgramArguments</key><array>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
The reader doesn't need Gmail credentials, so none are passed to it. For remote access, add BRIEFED_TOKEN and BRIEFED_ALLOWED_HOSTS (see SKILL.md → Reading on another device) under an EnvironmentVariables dict.
launchctl load ~/Library/LaunchAgents/ai.openclaw.briefed.plist
The skill performs sensitive actions including shell execution, network access, file reads/writes, and environment-variable handling, but it does not declare an explicit tool/permission scope. That creates an over-privilege risk: an agent runtime may grant broader capabilities than are actually needed, increasing blast radius if the skill is misused or prompt-injected.
The skill explicitly sets up a daily cron job and persists OAuth tokens, newsletter content, notes, and behavioral signals on disk across sessions. Even though this is disclosed and appears product-motivated, persistent scheduled execution and long-lived local data increase exposure to unauthorized access, stale-token abuse, and privacy leakage if the host is compromised.
- The OAuth token is stored locally at `~/.openclaw/workspace/briefed-gmail-token.json` (or `BRIEFED_GMAIL_TOKEN_FILE`) with owner-only (`0600`) permissions. All data files are written `0600` too.
- The reader listens on **`127.0.0.1` only** and rejects requests with a foreign `Host` header. Remote access (e.g. from a phone) is opt-in, requires a token, and should go over HTTPS (Tailscale Serve). Unencrypted LAN access needs an explicit `BRIEFED_ALLOW_PLAIN_HTTP=1`. See [Reading on another device](#reading-on-another-device).
- Email HTML renders in a sandboxed iframe with no script execution. Remote images are blocked by default so senders can't track opens; the user can load them per email.
- The workflow should only read/write the workspace files listed in the metadata above, plus the skill's own directory.
- Do not send newsletter content to external endpoints other than the configured model provider and the user-selected notification channel.
- **Do not create persistent services (LaunchAgent, systemd unit, login item) unless the user explicitly asks.** The daily cron job is the only scheduled task this skill needs; confirm with the user before creating it.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
skipSenders — sender-name substrings (e.g. banks, shops)skipSnippetPatterns — snippet substringsTo add your own rules, create ~/.openclaw/workspace/newsletter-filter-rules.json with any of the same keys. They are added to the defaults, and the file lives outside the skill directory, so updating Briefed won't overwrite it:
{
This JSON manifest defines activation-like filtering conditions using short, common phrases such as "refund" and "verify your email" without any scope constraints or exclusion examples. Because these patterns are broad and context-free, they can match many unrelated legitimate emails and cause unintended skipping behavior.
Opening an email automatically sends a hidden '/api/vote' event with vote:'open', creating behavioral tracking without clear disclosure or consent. In a newsletter intelligence app, this can build engagement profiles and may violate user expectations or privacy requirements, especially because it happens on view rather than explicit interaction.
The dependency version for Express is specified with a caret range (^5.1.0), which allows automatic installation of newer compatible releases rather than a single fixed version. This can introduce supply-chain risk and reduce build reproducibility, since a later upstream release could contain a vulnerability or unexpected behavior and would be pulled in without an explicit review.
"dev": "node --watch server.js"
},
"dependencies": {
"express": "^5.1.0"
},
"engines": {
"node": ">=18"
No suspicious patterns detected.