Security audit

Google Workspace BYOK

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it needs Review because it handles Google mail/calendar tokens and attachments with overbroad permissions and unsafe file path controls.

Review before installing. Use the --readonly authorization mode unless Calendar writes are truly needed, keep ~/.openclaw/google-workspace-byok owner-only, avoid shared machines, and be careful downloading email attachments because crafted filenames could overwrite files outside the target folder. Revoke the Google OAuth grant if you stop using the skill.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/shared.js:45
Finding: Account Label Path Traversal Enables Token File Access Outside the Token Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gmail.js:242
Finding: Attachment Filename Path Traversal Enables Writes Outside the Selected Output Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/shared.js:24
Finding: OAuth Credentials and Refresh Tokens Are Stored Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/shared.js:14
Finding: Full Calendar Read/Write OAuth Scope Is Requested by Default Despite Read-Only Implementation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code’s behavior is a subset of the declared description: it clearly supports calendar-related read actions and multi-account selection via an account label, which aligns with part of the description. However, the declared purpose prominently describes a combined Google Calendar and Gmail integration with substantial Gmail-related capabilities, while the provided code chunk contains only calendar access logic. There is no evidence here of email access, Gmail search, attachment download, or PDF text extraction. This is a description-versus-code mismatch for the supplied chunk because the declared functionality materially exceeds what this code actually does, even though the implemented calendar capabilities themselves are accurately described.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The skill instructs users to copy OAuth client credentials into a fixed local path under ~/.openclaw/google-workspace-byok/credentials.json. Storing sensitive OAuth material in a predictable location raises the risk of credential theft by other local processes, misconfigured permissions, backups, or accidental disclosure.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Run the setup script:

bash
node {baseDir}/scripts/setup.js --credentials /path/to/downloaded-credentials.json

This copies your credentials to ~/.openclaw/google-workspace-byok/credentials.json.

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: This section continues the same insecure credential-handling pattern by directing persistence of OAuth credentials in a predictable file path. If compromised, these credentials can facilitate unauthorized OAuth flows and access to connected Google data.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
node {baseDir}/scripts/setup.js --credentials /path/to/downloaded-credentials.json

text
This copies your credentials to `~/.openclaw/google-workspace-byok/credentials.json`. ### Step 5: Authorize Google Accounts

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The documented file layout explicitly stores both OAuth client credentials and per-account tokens on disk under a fixed directory. Those token files likely contain refresh tokens, which can grant persistent access to Gmail and Calendar across multiple accounts if exfiltrated.
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
text
~/.openclaw/google-workspace-byok/ ├── credentials.json # Your GCP OAuth credentials └── tokens/ ├── personal.json # Token for "personal" account └── work.json # Token for "work" account

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Referencing credentials.json here reinforces the insecure credential-storage model and discusses redirect URI configuration tied to that local credential file. While not a separate exploit by itself, it is part of the same pattern of handling sensitive OAuth material in a predictable local file.
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
md
Apps in "Testing" publishing status issue tokens that expire after 7 days. Publish your app to "Production" for long-lived tokens. For personal Gmail (External user type), you can skip verification and just accept the "unverified app" warning. ### `Error: redirect_uri_mismatch` Your credentials.json doesn't include `http://localhost` as a redirect URI. Edit your OAuth client in GCP Console → **Authorized redirect URIs** → add `http://localhost`. ### `npm install` fails or `mupdf` won't install `mupdf` requires a C++ build toolchain on some platforms. If it fails, you can still use all other features — PDF text extraction is the only feature that requires it. Try: `npm install --ignore-scripts` to skip native compilation, then install `mupdf` separately if needed.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: brace-expansion 2.0.2 is flagged with multiple DoS-style advisories involving pathological brace patterns that can trigger excessive CPU or memory use. In this lockfile it is a transitive dependency of minimatch/glob/rimraf, so the risk depends on whether untrusted glob-like patterns can reach that code path; in a Gmail/Calendar skill, attacker-controlled email metadata, attachment names, or search-like inputs could increase exposure if reused in file or pattern matching.
Content: No source excerpt is available for this finding.

Possible Typosquatting: 'gaxios' resembles popular package 'axios'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==9.0.5 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

Category: Supply Chain
Confidence: 94% confidence
Finding: minimatch 9.0.5 is reported with multiple ReDoS/backtracking vulnerabilities, which can allow crafted glob patterns to consume excessive CPU. This is especially relevant in automation tooling because file selection, ignore lists, and cleanup logic often process user- or environment-influenced patterns; while the lockfile alone does not prove exploitability, the dependency is genuinely vulnerable.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.js (reported line 3)May include surrounding context.
js
/** * Setup script — copies Google OAuth credentials into the config directory. * Usage: node setup.js --credentials /path/to/credentials.json */ const fs = require('fs');

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.js (reported line 12)May include surrounding context.
js
/** * Setup script — copies Google OAuth credentials into the config directory. * Usage: node setup.js --credentials /path/to/credentials.json */ const fs = require('fs');

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/shared.js (reported line 11)May include surrounding context.
js
/** * Setup script — copies Google OAuth credentials into the config directory. * Usage: node setup.js --credentials /path/to/credentials.json */ const fs = require('fs');

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/shared.js (reported line 33)May include surrounding context.
js
/** * Setup script — copies Google OAuth credentials into the config directory. * Usage: node setup.js --credentials /path/to/credentials.json */ const fs = require('fs');

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/shared.js (reported line 40)May include surrounding context.
js
/** * Setup script — copies Google OAuth credentials into the config directory. * Usage: node setup.js --credentials /path/to/credentials.json */ const fs = require('fs');

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation guidance is broad enough that the skill may be invoked for many generic email or calendar-related requests. In a high-sensitivity integration that can read mail, download attachments, and access multiple accounts, overly broad routing increases the chance of unnecessary access to private data.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
This installs `googleapis` (Google API client) and `mupdf` (PDF text extraction for email attachments). ### Step 2: Create a Google Cloud Project 1. Go to [Google Cloud Console](https://console.cloud.google.com) and create a new project (or use an existing one) 2. Enable the **Google Calendar API** and **Gmail API**:

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requests full calendar scope by default while presenting the integration in a largely read-oriented context. Overbroad OAuth scopes violate least privilege and increase damage if tokens are stolen or the skill is misused, because an attacker could modify or delete calendar data rather than only read it.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
md
The refresh token expired or was revoked. Re-run `node {baseDir}/scripts/auth.js --account <label>` to re-authorize. ### Tokens expire after 7 days Apps in "Testing" publishing status issue tokens that expire after 7 days. Publish your app to "Production" for long-lived tokens. For personal Gmail (External user type), you can skip verification and just accept the "unverified app" warning. ### `Error: redirect_uri_mismatch` Your credentials.json doesn't include `http://localhost` as a redirect URI. Edit your OAuth client in GCP Console → **Authorized redirect URIs** → add `http://localhost`.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code performs network calls to Google Calendar and outputs detailed event data including descriptions, locations, organizer/creator emails, attendee lists, and links. There is no confirmation prompt or explicit warning in the file that these results may contain sensitive personal or organizational data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The get-event path fetches a specific calendar event and prints complete creator, organizer, attendees, recurrence, reminders, and other event metadata. Because this is a code file handling potentially sensitive calendar content, the absence of an explicit warning or disclosure is a safety concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The attachment action writes Gmail attachment contents directly to a filesystem path derived from user-controlled inputs (--out-dir and potentially --filename) without any confirmation, restriction, or safety guard. In an agent/skill context, silent file writes can be abused to drop arbitrary content on disk, overwrite existing files, or stage follow-on attacks, especially because the data source is untrusted email content and the default behavior is to persist it locally.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill defines a full calendar read/write OAuth scope even though the described functionality in the metadata is primarily read-oriented (listing calendars, getting events, checking free/busy). This violates least privilege and, if this scope is ever requested or used, a compromised skill or downstream bug could modify or delete calendar data unnecessarily.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code creates local directories for OAuth credentials and tokens, and later persists token data to disk. While the file has developer-oriented comments, it does not include any user-facing warning, confirmation, or disclosure that sensitive authentication material will be stored under the user's home directory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: OAuth tokens are persisted in plaintext JSON on disk under the user's home directory, and the code does not set restrictive file permissions or use an OS credential store. If another local user, process, or malware can read these files, the attacker may gain ongoing access to the victim's Gmail and Calendar data across linked accounts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This action performs a Google Calendar API request using the selected calendar ID and returns availability data, which can still reveal sensitive scheduling patterns. The code does not provide a user-facing disclosure that calendar availability information will be queried and printed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.