ClawHub
Back to skill

Security audit

Google Workspace

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly describes a Google Workspace automation helper, but users should understand it can read and change real Gmail, Drive, Calendar, Docs, Sheets, and Slides data once authorized.

Install only for a Google account where you are comfortable granting automation access. Review the OAuth scopes and be deliberate when asking it to send email, share files, trash items, edit documents, or refresh credentials on a trusted machine.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
You have 24 direct-OAuth tools spanning Gmail, Calendar, Drive, Docs, Sheets, and Slides. They talk straight to `googleapis.com` (no MCP, no third-party gateway, no IMAP App Password). Per-file Google ACLs decide what's read-only vs writable.

## Rule zero: never narrate, always re-call

Every tool below performs a real network call against Google. The underlying data **changes between turns** — new mail arrives, the user adds calendar events, files appear in shared folders, sheet cells update. When the user asks anything like "do you see it now / what's new / did it arrive / what changed", **call the tool again from scratch**. Never reuse a previous tool result as the answer to a fresh question. Never say "let me check" without then immediately calling the relevant tool — those words must be followed by an actual tool invocation in the same turn.
Confidence
93% confidence
Finding
The skill grants broad operational guidance across Gmail, Drive, Calendar, Docs, Sheets, and Slides, with repeated instructions to immediately execute matching tools on request. Although some dangerous actions mention user intent in prose, there is no centralized authorization or confirmation policy for sensitive read/write operations, so a prompt-injected or socially engineered request could trigger real data access, modification, deletion, or sharing across the connected Google account.

Missing User Warnings

Low
Confidence
77% confidence
Finding
This markdown file documents that `google_auth_complete` "writes a fresh token file," which is a filesystem-modifying action involving credentials. While the file explains the OAuth flow, it does not explicitly warn the user at that step that local credential material will be written or updated on disk.

Static analysis

No suspicious patterns detected.