ClawHub
Back to skill

Security audit

Book Google Meet

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for creating Google Meet meetings, but it needs review because it stores Google OAuth tokens unsafely and asks for broader Calendar access than the script appears to need.

Review before installing. Use this only in a trusted local workspace, understand that OPEN meetings allow broad link-based access, and prefer a patched version that avoids pickle, stores tokens with owner-only permissions or a keychain, and removes the unnecessary broad Calendar scope. Revoke the Google OAuth token if the token file may have been exposed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
book_meeting.py:132
Finding

Unsafe Deserialization of a User-Controllable OAuth Token File

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
book_meeting.py:145
Finding

OAuth Refresh Token Written Without Enforced Restrictive Permissions

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
book_meeting.py:33
Finding

Google Calendar OAuth Authorization Exceeds Demonstrated Functional Requirements

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:4
Finding

Unbounded Dependency Versions Produce Non-Reproducible Installations

Content
View full analysis
=2.0.0 google-auth-oauthlib>=1.0.0 google-api-python-client>=2.0.0 ``` ### Technical Analysis The dependency declarations specify only minimum versions and have no upper bounds, exact pins, lock file, or package hashes. Each installation can therefore resolve to different future releases that were not part of the audited artifact. The listed packages use expected official names, and no evidence of typosquatting, dependency confusion, or an unsafe package source was found. The risk arises from allowing unreviewed future versions and transitive dependency changes to enter the execution environment automatically. ### Attack Path 1. The user follows the documented command `pip install -r requirements.txt`. 2. The package resolver selects the newest releases satisfying the open-ended minimum constraints. 3. A future direct or transitive dependency release contains a compromise, exploitable defect, or unexpected behavior. 4. The package is installed without being constrained to an audited version or verified against a recorded hash. 5. Malicious installation hooks or runtime code execute with the privileges of the installing or invoking user. ### Impact Assessment The primary impact is loss of build reproducibility and exposure to unreviewed supply-chain changes. If a resolved dependency is compromised, code could execute under the installing user's privileges and access the same local files, OAuth credentials, and network resources as the Skill. No currently malicious package is established by the audited files, so the present risk level is low. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose says the skill creates Google Meet spaces with OPEN access, but the document also describes the ability to create TRUSTED and RESTRICTED meetings and to use OAuth credentials with local token storage. This mismatch can mislead users and policy engines about what the skill actually does, increasing the chance of unsafe approval or misuse of privileged Google account access.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · book_meeting.py (reported line 102)May include surrounding context.

python
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · book_meeting.py (reported line 104)May include surrounding context.

python
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · book_meeting.py (reported line 120)May include surrounding context.

python
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · book_meeting.py (reported line 121)May include surrounding context.

python
"google-auth-oauthlib",
                "google-api-python-client",
              ],
            "files": ["client_secrets.json", "book_meeting.py"],
            "primaryEnv": ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
            "writes": ["meeting_token.pickle"],
          },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · book_meeting.py (reported line 103)May include surrounding context.

python
default_paths = [
        'client_secrets.json',
        'credentials.json',
        os.path.expanduser('~/.config/google-meet/client_secrets.json'),
        os.path.expanduser('~/.config/google-meet/credentials.json'),
    ]

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · book_meeting.py (reported line 105)May include surrounding context.

python
default_paths = [
        'client_secrets.json',
        'credentials.json',
        os.path.expanduser('~/.config/google-meet/client_secrets.json'),
        os.path.expanduser('~/.config/google-meet/credentials.json'),
    ]

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares capabilities that require environment access, file reads, local token writes, and outbound network use, but it does not explicitly declare tool scope or permissions. In an agent ecosystem, this weakens transparency and consent boundaries, making it easier for a user or orchestrator to invoke a credentialed workflow without clearly understanding the access being granted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Defaulting meetings to OPEN means anyone with the link may join, which creates a real privacy and confidentiality risk if users assume normal invite-only behavior. In a scheduling skill, this context makes the issue more dangerous because the insecure default directly affects real meetings and can expose internal discussions to unintended participants.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

The skill is explicitly designed to create Google Meet spaces with OPEN access, which weakens meeting access controls and increases the chance of unintended attendance, link-sharing abuse, or meeting disruption. In this skill context, that behavior is the core function, so it materially increases risk compared with a normal scheduling tool even if it is not covertly malicious.

Content

Scanner excerpt · book_meeting.py (reported line 2)May include surrounding context.

python
#!/usr/bin/env python3
"""Create a scheduled Google Calendar event with OPEN access Meet space.

Workflow:
1. Create Calendar event with Meet conference (Calendar API)

Insecure deserialization: pickle.load()

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

The script deserializes OAuth credentials from a pickle file using pickle.load(), which can execute arbitrary code if the file is replaced or tampered with. In this skill’s context, the token path is user-controlled and defaults to a local file, so any attacker who can plant or swap that file can achieve code execution when the script starts.

Content

Scanner excerpt · book_meeting.py (reported line 135)May include surrounding context.

python
if os.path.exists(token_path):
        with open(token_path, 'rb') as token:
            creds = pickle.load(token)

    if not creds or not creds.valid:
        if creds and creds.expired and creds.refresh_token:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script silently writes refreshed OAuth credentials to disk, creating a persistent token that may outlive the session and be exposed through weak filesystem permissions, backups, or shared workspaces. Because the stored token grants Google Calendar and Meet access, theft of the file can enable unauthorized meeting and calendar actions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with only a lower bound, which allows installation of any newer version, including potentially incompatible or compromised releases. This weakens build reproducibility and increases supply-chain risk if a malicious or vulnerable upstream version is pulled in later.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
# Required packages for book-google-meet
# Install with: pip install -r requirements.txt

google-auth>=2.0.0
google-auth-oauthlib>=1.0.0
google-api-python-client>=2.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using an unpinned minimum version permits dependency drift over time, so future installations may resolve to unexpected versions with security flaws or breaking behavior. For an OAuth-related library, this can indirectly affect authentication flows if a bad upstream release is consumed.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text
# Install with: pip install -r requirements.txt

google-auth>=2.0.0
google-auth-oauthlib>=1.0.0
google-api-python-client>=2.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

This package is also unpinned, meaning the environment may install different versions across deployments and over time. Because this client library interacts with Google APIs used to create calendar events and Meet links, an unsafe upstream release could affect sensitive scheduling functionality or credential-handling paths.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text
google-auth>=2.0.0
google-auth-oauthlib>=1.0.0
google-api-python-client>=2.0.0

Static analysis

No suspicious patterns detected.