gmail-cleanup

• Outcome: Pass
• Latest audit: Oct 12, 2026 · 5:08 AM UTC
• Version: 1.0.5

Overview

This skill is a disclosed Gmail cleanup workflow that reads inbox data, sends approval digests to Telegram, and only applies mailbox changes after explicit approval gates.

Install only for Gmail accounts and Telegram targets you control. Review the config query, action policies, and max-action cap before scheduling; keep `GOG_KEYRING_PASSWORD` in a session or secret manager; inspect pending and approved action files; and run dry-run before using `--apply` or `--send`.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a Gmail-management workflow with approval-gated cleanup actions via Telegram. The provided code chunk only implements sending an arbitrary message to a configured Telegram/OpenClaw target. That may be a supporting component of a larger workflow, but on its own it does not perform the core declared behaviors: triaging inbox mail, drafting replies, or gating archive/trash actions on approval. It also introduces an outbound messaging capability that is not reflected in the declared permissions. Therefore the code chunk's actual behavior does not accurately match the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broader workflow: inbox triage into spam/info/action lanes, drafting replies, and approval-gated cleanup actions through Telegram. The supplied code chunk only implements the initial read-only scanning stage. It queries Gmail, retrieves thread/message details, normalizes selected fields, and saves them to state/gmail-cleanup/latest.json. It explicitly states and enforces that it performs no mutations. While this scan could support the declared workflow, by itself it does not implement key described capabilities such as categorization, drafting replies, Telegram-based approval, or archive/trash actions. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

than typed in plaintext:

bash

export GOG_KEYRING_PASSWORD='<your gog keyring password>'   # current session only
# or, sourced from a secret manager:
export GOG_KEYRING_PASSWORD="$(pass show gog-keyring)"      # current session only

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

than typed in plaintext:

bash

export GOG_KEYRING_PASSWORD='<your gog keyring password>'   # current session only
# or, sourced from a secret manager:
export GOG_KEYRING_PASSWORD="$(pass show gog-keyring)"      # current session only

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cleanup-execute.py (reported line 18)May include surrounding context.

python

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cleanup-execute.py (reported line 68)May include surrounding context.

python

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cleanup-execute.py (reported line 70)May include surrounding context.

python

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/triage-scan.py (reported line 8)May include surrounding context.

python

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/triage-scan.py (reported line 18)May include surrounding context.

python

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/triage-scan.py (reported line 45)May include surrounding context.

python

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/triage-scan.py (reported line 47)May include surrounding context.

python

JSON file (state/gmail-cleanup/latest.json) for the agent to classify.
Performs NO mutations.

Credentials: read from the GOG_KEYRING_PASSWORD environment variable ONLY. This
script never reads credential files. The Workspace CLI is invoked as `gog` from
PATH; no executable override is honored.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill document describes capabilities that require shell, network, environment-variable, and file-write access, but it does not declare an explicit tool/permission scope. That creates an avoidable trust gap: a reviewer or runtime may permit broader access than intended, making misuse or later drift harder to detect.

Content

No source excerpt is available for this finding.

Tainted flow: 'audit' from os.environ.get (line 92, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 87% confidence

Finding

The audit log path is derived from GMAIL_CLEANUP_STATE, which is fully controlled by the environment, and the code appends to that path without validating or constraining it. In a shared or higher-privilege execution context, an attacker who can influence the environment could redirect writes to unintended files via arbitrary paths or symlinks, causing file clobbering or tampering.

Content

Scanner excerpt · scripts/cleanup-execute.py (reported line 96)May include surrounding context.

python

def record(line):
    with open(audit, "a") as f:
        f.write(line + "\n")
    print(line)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cleanup-execute.py (reported line 110)May include surrounding context.

python

delay = 2.0
    r = None
    for attempt in range(retries + 1):
        r = subprocess.run(base, capture_output=True, text=True)
        out = (r.stdout + r.stderr).strip()
        if r.returncode == 0 or not any(h in out.lower() for h in RATE_HINTS):
            return r.returncode, out

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends the full contents of the provided message body to an external messaging channel via openclaw message send. There is no confirmation prompt, user-facing disclosure, or explanatory comment warning that input data will be transmitted off-system to Telegram, which is a privacy-relevant network action.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/triage-scan.py (reported line 80)May include surrounding context.

python

delay = 2.0
    last = ""
    for attempt in range(retries + 1):
        r = subprocess.run([GOG, *args, "-a", acc, "-j"], capture_output=True, text=True)
        out, err = r.stdout, r.stderr
        if r.returncode == 0:
            return json.loads(out)

Tainted flow: 'acc' from open (line 56, file read) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/triage-scan.py (reported line 80)May include surrounding context.

python

delay = 2.0
    last = ""
    for attempt in range(retries + 1):
        r = subprocess.run([GOG, *args, "-a", acc, "-j"], capture_output=True, text=True)
        out, err = r.stdout, r.stderr
        if r.returncode == 0:
            return json.loads(out)

Tainted flow: 'STATE' from os.environ.get (line 29, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 82% confidence

Finding

The output path is derived from GMAIL_CLEANUP_STATE, an environment variable, and the script writes latest.json there without validating that the directory is trusted. In an agent/runtime context, a caller who can influence environment variables could redirect writes to arbitrary filesystem locations or symlink targets accessible to the process.

Content

Scanner excerpt · scripts/triage-scan.py (reported line 164)May include surrounding context.

python

"skipped": skipped,
    "candidates": candidates,
}
with open(os.path.join(STATE, "latest.json"), "w") as f:
    json.dump(out, f, indent=2)
print(
    f"triage-scan: {len(candidates)} candidates ({skipped} skipped) "

Static analysis

No suspicious patterns detected.