Security audit
Security checks for vulnerabilities and agentic risk
This skill is a real Gmail link archiver, but it stores a reusable Gmail app password locally and automatically crawls email-supplied URLs with too little containment.
Install only if you are comfortable granting this skill persistent Gmail IMAP access and letting it browse links found in matching emails from your machine. Use a dedicated Gmail app password, revoke it when finished, review the saved config file, keep the subject prefix hard to guess, and avoid running setup or Playwright dependency commands with administrator privileges. A safer version would use an OS keychain, pinned dependencies, URL review, and blocking of localhost, private networks, cloud metadata addresses, and unsafe redirects.
references/gmail_link_archiver.py:162Attacker-Controlled Email Links Can Access Internal Network Resources
references/gmail_link_archiver.py:44Gmail App Password Is Stored Persistently in Plaintext
references/setup.sh:40Automatic Installation of Unpinned Dependencies and Browser Components
The skill launches subprocesses for pip and Playwright installation, and the analyzer reports shell/process execution capability as undeclared. In an agent platform, undeclared process execution materially raises risk because it allows environment modification and execution of external tooling beyond the core archiving task.
The skill launches subprocesses for pip and Playwright installation, and the analyzer reports shell/process execution capability as undeclared. In an agent platform, undeclared process execution materially raises risk because it allows environment modification and execution of external tooling beyond the core archiving task.
The skill launches subprocesses for pip and Playwright installation, and the analyzer reports shell/process execution capability as undeclared. In an agent platform, undeclared process execution materially raises risk because it allows environment modification and execution of external tooling beyond the core archiving task.
The skill launches subprocesses for pip and Playwright installation, and the analyzer reports shell/process execution capability as undeclared. In an agent platform, undeclared process execution materially raises risk because it allows environment modification and execution of external tooling beyond the core archiving task.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
python3 -m playwright install chromium
sudo python3 -m playwright install-deps chromium
**No emails found?**
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Permission denied on config file?
chmod 600 ~/.config/gmail-link-archiver/config.json
The skill persistently stores Gmail IMAP credentials, including the app password, in a local JSON config file. While file permissions are tightened, plaintext credential storage on disk increases the blast radius of local compromise, accidental backups, or other processes reading the user's home directory.
The setup interview collects a Gmail app password and later saves it to disk, but the collection flow does not explicitly warn the user at input time that the secret will be stored persistently. In a security-sensitive skill, lack of timely disclosure weakens informed consent and can lead to users exposing long-lived credentials without understanding retention.
Automatically installing software and system dependencies goes beyond the stated purpose of archiving links from email and meaningfully broadens the trust boundary. In skill contexts, this is dangerous because it combines network fetches, package execution, and host modification without a separate approval step.
The script installs the Playwright Python package at runtime via pip. This creates a supply-chain and arbitrary code execution risk because package installation executes code from external repositories in the current environment without a review or explicit approval step.
except ImportError:
print("[SETUP] Installing Playwright...")
try:
subprocess.check_call([sys.executable, "-m", "pip", "install", "playwright"])
except subprocess.CalledProcessError as e:
print(f"[ERROR] Failed to install Playwright: {e}")
return False
The code executes a subprocess to install Chromium at runtime. Although it does not interpolate attacker-controlled shell input, it expands the skill's capabilities by downloading and installing executable software during normal operation, which is risky in constrained agent environments and can lead to unexpected code execution from external package sources.
print("[SETUP] Installing Chromium browser...")
try:
subprocess.check_call([sys.executable, "-m", "playwright", "install", "chromium"])
except subprocess.CalledProcessError as e:
print(f"[ERROR] Failed to install Chromium: {e}")
return False
This subprocess invokes Playwright's install-deps flow, which may trigger privileged system package installation or modification of host dependencies. In an agent skill, changing system packages exceeds the expected scope of email-link archiving and materially increases host impact if abused or if the dependency source is compromised.
# Install system deps for headless Chromium on Linux (best-effort)
try:
subprocess.check_call(
[sys.executable, "-m", "playwright", "install-deps", "chromium"],
stderr=subprocess.DEVNULL,
)
The code installs html2text at runtime through pip, introducing the same supply-chain and environment-modification risk as other dynamic installs. Even though the command is not shell-injected, it still causes unreviewed third-party code to be fetched and executed on the host.
except ImportError:
print("[SETUP] Installing html2text...")
try:
subprocess.check_call([sys.executable, "-m", "pip", "install", "html2text"])
except subprocess.CalledProcessError as e:
print(f"[ERROR] Failed to install html2text: {e}")
return False
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
filename = f"{url_slug}_{url_hash}.md"
filepath = os.path.join(workspace_path, filename)
with open(filepath, "w", encoding="utf-8") as f:
f.write(md_content)
return filepath
The pipeline automatically crawls links extracted from emails without a confirmation step at the point of outbound access. Because email content is attacker-controllable, this can trigger requests to malicious or tracking URLs, leak IP/browser metadata, or reach internal network targets if the skill runs in a trusted environment.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if [ -z "$PYTHON" ]; then
echo "[ERROR] Python 3 is required but not found."
echo "Install with: sudo apt-get install python3 python3-pip"
exit 1
fi
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if [ -z "$PYTHON" ]; then
echo "[ERROR] Python 3 is required but not found."
echo "Install with: sudo apt-get install python3 python3-pip"
exit 1
fi