ClawHub
Back to skill

Security audit

Gmail Enhanced

Security checks for vulnerabilities and agentic risk

Overview

This Gmail skill does what it says, but it handles powerful mailbox access, persistent OAuth tokens, automatic replies, and attachment downloads with insufficient safety controls.

Review this carefully before installing. Use a dedicated Google OAuth client with the minimum Gmail scopes you need, keep credential and token files private, avoid shared machines or repos, and do not run attachment downloads or auto-reply rules unless you trust the mailbox inputs and have added filename validation, overwrite protection, confirmation, and rate limits.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
gmail_enhanced.py:483
Finding

Untrusted Attachment Filename Allows Arbitrary File Overwrite

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
gmail_enhanced.py:82
Finding

Gmail OAuth Refresh Token Is Stored Without Explicit Restrictive Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Referencing credentials.json in itself is expected for OAuth-based Gmail integration, but the skill normalizes handling raw credential material without security controls or warnings. In context, this increases the chance that users will download, store, and reuse sensitive client secrets insecurely, enabling account compromise if those files are stolen.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
1. Enable Gmail API in Google Cloud Console
2. Create OAuth 2.0 credentials
3. Download credentials.json
4. Generate tokens.json (run once with authentication)

## Configuration

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The environment variable examples directly point to credential and token file paths, signaling that the skill will access high-value authentication artifacts from the local environment. Without guidance on secure handling, this can lead to accidental disclosure through shell history, process inspection, misconfigured environments, or shared execution contexts.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Configuration

bash
export GMAIL_CREDENTIALS_PATH="/path/to/credentials.json"
export GMAIL_TOKEN_PATH="/path/to/tokens.json"

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

Publishing predictable default locations for Gmail credential and token files makes discovery easier on shared or compromised systems, especially if permissions are weak. Because these files can grant persistent Gmail access, their presence in standard paths materially raises the risk of credential theft.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

text

Or place credentials in default locations:
- `~/.credentials/gmail-credentials.json`
- `~/.credentials/gmail-token.json`

## Usage

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · gmail_enhanced.py (reported line 40)May include surrounding context.

python
):
        self.credentials_path = credentials_path or os.getenv(
            "GMAIL_CREDENTIALS_PATH",
            "~/.credentials/gmail-credentials.json"
        )
        self.token_path = token_path or os.getenv(
            "GMAIL_TOKEN_PATH",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill describes capabilities that inherently require environment variable access, filesystem reads/writes, and network access, but it does not declare any tool scope or permissions boundary. This creates an authorization gap where the runtime may grant broader access than users expect, increasing the risk of credential exposure, unintended mailbox modification, or unsafe attachment handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The attachment handling section promotes downloading, uploading, filtering, and extracting attachments to cloud storage without warning about malware, sensitive-data leakage, or unsafe storage locations. Attachments are a common delivery mechanism for malicious content, and automatic extraction or syncing can spread risk beyond the mailbox.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The email processing section advertises auto-categorization, data extraction, auto-reply rules, and bounce detection without clearly warning that these features can automatically send messages or modify mailbox state. Users may enable workflows that act on live email data without understanding the consequences, leading to unintended replies, data mishandling, or destructive mailbox changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The setup instructions tell users to create and store OAuth credential and token files, including default filesystem locations, but provide no warning that these files are highly sensitive secrets. If exposed through weak permissions, backups, logs, or shared systems, an attacker could gain lasting access to the user's Gmail account within the granted scopes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The instruction to generate tokens.json once and reuse it establishes session persistence, which is functionally normal for OAuth but also means a stolen token can provide ongoing access without repeated authentication. In the context of Gmail automation with modify/send scopes, persistent tokens meaningfully increase the blast radius of local compromise.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
## Prerequisites

1. Enable Gmail API in Google Cloud Console
2. Create OAuth 2.0 credentials
3. Download credentials.json
4. Generate tokens.json (run once with authentication)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · gmail_enhanced.py (reported line 303)May include surrounding context.

python
message_list_visibility: str = "show",
        color: str = None
    ) -> Dict:
        """Create label"""
        service = self._get_service()
        
        body = {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill can automatically download email attachments and write them to an arbitrary local path without any confirmation, filename sanitization, or trust boundary checks. In an agent setting, this creates a risky bridge from untrusted email content to the local filesystem, enabling silent persistence of attacker-controlled files or overwrite of existing files when filenames collide or paths are manipulated by the caller.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The rule engine can send outbound auto-reply emails automatically based on matching inbound messages, with no approval step, rate limiting, or sender validation. In practice this can be abused by malicious emails to trigger unsolicited responses, data leakage in replies, mail loops, or reputation damage from automated sending.

Content

No source excerpt is available for this finding.