phishguard

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:31 AM UTC
• Version: 1.0.0

Overview

PhishGuard has a coherent anti-phishing purpose, but it needs careful review because it continuously reads business email, sends email data to third parties, modifies Gmail labels, and contains unsafe shell-command handling.

Install only after reviewing this as a high-impact email-security automation. Use a dedicated monitored mailbox or tightly scoped Google account, avoid the curl-to-bash installer path, protect local env files, confirm what email fields may be sent to Anthropic and alert channels, and disable or constrain automatic labeling until command execution and scoping issues are fixed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: INSTALACION.md:14

Finding

Unpinned Remote Installation Script Is Executed Directly by Bash

Content

View full analysis

Remediation

View remediation

openclawd-install.sh" | sha256sum --check - less openclawd-install.sh bash openclawd-install.sh ``` 5. Prefer a pinned package-manager installation where package integrity and provenance are verifiable. 6. Explicitly warn users not to run the installer as root unless individual privileged operations are documented and strictly necessary. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: gmail-adapter.js:62

Finding

Shell Command Injection Through Gmail Message IDs and Label Names

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: ai-analyzer.js:18

Finding

Attacker-Controlled Email Content Can Manipulate LLM-Driven Automatic Gmail Actions

Content

View full analysis

" - " + u).join("\n") || " None"; const attachmentsStr = (email.attachments ?? []).map(a => " - " + a).join("\n") || " None"; return `Analyze this email for phishing: FROM: ${email.sender} REPLY-TO: ${email.replyTo ?? "Not set"} SUBJECT: ${email.subject} SPF: ${email.spfResult ?? "unknown"} | DKIM: ${email.dkimResult ?? "unknown"} BODY: ${(email.bodyText ?? "").slice(0, 2000)} URLS: ${urlsStr} ATTACHMENTS: ${attachmentsStr}`; } ``` The model-controlled score has majority weight: ```js calculate({ emailData, ruleMatches, ruleScore, aiIsPhishing, aiConfidence, aiScore, aiSummary, aiIndicators }) { let combined = (ruleScore * RULES_WEIGHT) + (aiScore * AI_WEIGHT); // Boost if AI is highly confident it is phishing if (aiIsPhishing && aiConfidence >= 0.85) { combined = Math.min(combined + 15, 100); } // Floor if any critical rule fired const hasCritical = ruleMatches.some(m => m.severity === "critical"); if (hasCritical) { combined = Math.max(combined, 55); } combined = Math.min(Math.round(combined * 10) / 10, 100); cons ...[truncated 3355 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (32)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · INSTALACION.md (reported line 22)May include surrounding context.

Google (Gmail) — se recomienda una cuenta dedicada para la empresa, no personal

• API key de Anthropic

---

Paso 1 — Instalar OpenClawd (si todavia no lo hiciste)

bash

# Con npm (recomendado)
npm i -g openclawd && openclawd onboard

# O con el instalador rapido
curl -fsSL https://openclawd.ai/install.sh | bash

Durante el onboard, selecciona Claude como motor de IA e ingresa tu ANTHROPIC_API_KEY.

---

Paso 2 — Instalar el skill "gog" (conector de Gmail)

gog es el skill oficial de OpenClawd para conectarse a Google Workspace (Gmail, Calendar, Drive). PhishGuard lo usa para leer y etiquetar correos.

bash

# Desde el dashboard de OpenClawd en tu browser
# http://TU_IP:18789/?token=TU_TOKEN

# Buscar "gog" en la lista de skills e instalarlo
# O desde la terminal:
openclawd skill install gog

Autenticar con tu cuenta de Google

bash

# Inicia el flujo OAuth de Google
gog auth login

Esto te va a abrir un link en el browser. Inicia sesion con la

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

La instrucción curl -fsSL https://openclawd.ai/install.sh | bash descarga y ejecuta código remoto sin verificación de integridad, firma ni revisión previa. Esto crea un vector directo de ejecución arbitraria si el servidor, la red o la cadena de suministro del instalador son comprometidos.

Content

Scanner excerpt · INSTALACION.md (reported line 19)May include surrounding context.

npm i -g openclawd && openclawd onboard

O con el instalador rapido

curl -fsSL https://openclawd.ai/install.sh | bash

text

Durante el `onboard`, selecciona Claude como motor de IA e ingresa tu `ANTHROPIC_API_KEY`.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

El pipe a bash encadena directamente datos remotos a un intérprete, eliminando oportunidades de validación y aumentando el riesgo de ejecución de payloads maliciosos. En una guía de instalación para un skill con acceso a correo y claves API, este patrón es especialmente peligroso porque el entorno instalado manejará credenciales y datos sensibles.

Content

Scanner excerpt · INSTALACION.md (reported line 19)May include surrounding context.

npm i -g openclawd && openclawd onboard

O con el instalador rapido

curl -fsSL https://openclawd.ai/install.sh | bash

text

Durante el `onboard`, selecciona Claude como motor de IA e ingresa tu `ANTHROPIC_API_KEY`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

La guía instruye almacenar secretos sensibles como ANTHROPIC_API_KEY y webhooks en archivos .env/config.env locales sin advertencias sobre permisos, exclusión de control de versiones o almacenamiento seguro. En un skill que procesa correo corporativo y usa servicios externos, la exposición de estos secretos podría permitir abuso de API, envío fraudulento de alertas o acceso indirecto a flujos sensibles.

Content

Scanner excerpt · INSTALACION.md (reported line 82)May include surrounding context.

bash

nano ~/.openclawd/config.env
# o
nano ~/.openclawd/.env

Agregar estas lineas:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

La descripción declara un sistema integral de detección y respuesta para Gmail/Outlook, pero el fragmento de código solo cubre una parte acotada: análisis semántico de un correo mediante la API de Claude. Sí coincide parcialmente con el uso de IA para analizar phishing, pero faltan varias capacidades centrales y explícitas de la descripción, incluyendo integración con bandejas de entrada, reglas estáticas, acciones automáticas y canales de notificación. Por ello, la descripción sobrestima materialmente el comportamiento real mostrado en este código.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

La descripción presenta una solución completa de detección y respuesta a phishing para Gmail y Outlook. En cambio, este fragmento solo cubre una parte de infraestructura: acceso a Gmail mediante comandos CLI y transformación de mensajes a un formato utilizable por otros componentes. Aunque menciona etiquetas que podrían usarse para cuarentena o advertencia, aquí no existe lógica de detección, clasificación, decisión automática, integración con IA ni canales de notificación. La diferencia es material porque el propósito principal declarado es un sistema de análisis y respuesta anti-phishing, mientras que el código suministrado solo implementa un adaptador de Gmail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

La mayor parte de la descripción coincide con el comportamiento: hay monitoreo periódico, análisis con reglas e IA (Anthropic/Claude), asignación de niveles de riesgo y acciones automáticas según severidad, incluyendo notificaciones a Slack/Teams. Sin embargo, existe una diferencia material: la descripción promete Gmail y Outlook, pero el código solo contiene integración efectiva con Gmail (checkHealth, listUnread, getMessage, parseMessage, addLabel). No aparece ningún adaptador o lógica para Outlook. Además, la acción de 'poner en cuarentena' parece limitarse a aplicar una etiqueta de Gmail ('PhishGuard-Quarantine'), lo que puede ser una versión débil de cuarentena frente a lo declarado. Por estas discrepancias, especialmente la ausencia de Outlook, sí hay mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

La descripción presenta una solución completa de detección y respuesta ante phishing para bandejas de entrada empresariales, con múltiples integraciones y automatizaciones. Sin embargo, el fragmento de código suministrado solo contiene un componente parcial: un motor de reglas estáticas que inspecciona campos de un correo ya proporcionado como entrada. Aunque esta parte sí está relacionada con la detección de phishing, faltan varias capacidades centrales explícitamente declaradas: monitoreo de Gmail/Outlook, análisis por IA con Claude, clasificación textual del riesgo y acciones automáticas posteriores. Por tanto, la descripción no representa con precisión lo que este código realmente hace por sí solo.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that it sends email data to the Claude API for analysis, but it does not clearly warn users that full email contents and authentication headers may leave the mailbox and be transmitted to a third party. Because emails can contain sensitive personal, financial, legal, or internal business data, this omission creates a significant privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

La descripcion del skill promete monitorear tanto Gmail como Outlook, pero esta guia de instalacion solo instala y autentica un conector de Google Workspace/Gmail. No hay pasos, credenciales ni adaptadores documentados para Outlook, lo que sugiere una discrepancia entre el alcance declarado y la implementacion/operacion real disponible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

La guía configura API de Anthropic y webhooks de Slack/Teams, pero no explica que partes del contenido de los correos, metadatos o alertas pueden salir del entorno hacia terceros. Dado que el skill analiza correos de phishing y notifica a sistemas externos, esta omisión puede exponer información sensible y aumentar el riesgo de incumplimiento normativo o divulgación accidental.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · INSTALACION.md (reported line 110)May include surrounding context.

md

Si queres recibir alertas en Slack:

1. Ir a https://api.slack.com/apps
2. Crear una nueva app -> "From scratch"
3. Nombre: "PhishGuard", workspace: el de tu empresa
4. Ir a "Incoming Webhooks" -> activar -> "Add New Webhook to Workspace"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

La guía invita a iniciar un monitoreo continuo y automatizado, pero no advierte claramente que el skill leerá correos de forma periódica y los modificará mediante etiquetas/cuarentena. En un contexto corporativo de correo, esta omisión reduce el consentimiento informado y puede llevar a despliegues inseguros o incumplimientos internos de privacidad y cambio de datos.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · INSTALACION.md (reported line 232)May include surrounding context.

No llegan alertas a Slack

bash

# Probar el webhook manualmente
curl -X POST $SLACK_WEBHOOK_URL \
  -H "Content-Type: application/json" \
  -d '{"text": "Prueba de PhishGuard"}'

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares access to environment variables and describes network-dependent behavior, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege boundaries and can cause the runtime or user to grant broader access than necessary, especially for mailbox monitoring and outbound notifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill performs background monitoring and can automatically quarantine messages, but the description does not present this as a clear warning requiring informed consent. Automatic actions on a live mailbox can affect availability of legitimate emails, create business disruption, and surprise users if enabled silently.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The hardcoded Anthropic endpoint confirms that email content is sent outside the local environment to an external vendor. While not inherently malicious, this is security-relevant because the skill processes enterprise email and may forward sensitive or regulated information to a third party.

Content

Scanner excerpt · ai-analyzer.js (reported line 22)May include surrounding context.

js

const prompt = this.buildPrompt(email);

    try {
      const response = await fetch("https://api.anthropic.com/v1/messages", {
        method: "POST",
        headers: {
          "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The hardcoded Anthropic endpoint confirms that email content is sent outside the local environment to an external vendor. While not inherently malicious, this is security-relevant because the skill processes enterprise email and may forward sensitive or regulated information to a third party.

Content

Scanner excerpt · ai-analyzer.js (reported line 22)May include surrounding context.

js

const prompt = this.buildPrompt(email);

    try {
      const response = await fetch("https://api.anthropic.com/v1/messages", {
        method: "POST",
        headers: {
          "Content-Type": "application/json",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code sends email-derived content, including sender, reply-to, subject, body text, URLs, and attachment names, to Anthropic's external API for analysis. In a phishing-monitoring skill this may be functionally intended, but without clear disclosure, consent, minimization, and policy controls it creates a real privacy and data-governance risk because potentially sensitive mailbox content leaves the tenant boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

El adaptador usa child_process.exec para construir y ejecutar comandos de shell con interpolacion de valores como messageId, labelName y maxResults. Aunque invoca un CLI de Gmail legitimo, el uso de exec introduce superficie de inyeccion de comandos si esos valores llegan a ser controlables, y ademas concede capacidad de ejecucion de sistema innecesariamente amplia para un skill que procesa correo.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code reads Gmail message contents and modifies message labels by invoking gog through shell commands, which can affect user data and mailbox state. Although there are developer comments, there is no user-facing disclosure, confirmation prompt, or visible logging at the point these operations occur.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Slack notification content is written in Spanish strings such as "Alerta PhishGuard" and "Analisis de IA" with no indication that users can choose a language or that the skill is intentionally limited to a Spanish-speaking context. This creates a natural-language locale policy issue because the skill forces a specific language in user-facing output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Teams message summary and facts use Spanish-only phrasing such as "correo de riesgo" and "Analisis de IA" with no user choice or documented locale restriction. Forcing a single language in natural-language output can violate organizational language or locale policies.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The package description advertises continuous monitoring of Gmail/Outlook mailboxes with AI analysis but does not state any trigger boundaries, consent requirements, tenant scoping, or activation constraints. In a security automation skill that can inspect incoming mail and take automated actions, this ambiguity increases the risk of over-collection, unauthorized surveillance, or unintended deployment across broader inbox scope than intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

El manifiesto promete vigilar bandejas de Gmail y Outlook, pero en este archivo solo se instancia un GmailAdapter y todo el flujo de health check, listado, obtencion y etiquetado de mensajes depende exclusivamente de Gmail. No hay ninguna ruta de codigo equivalente para Outlook, por lo que la capacidad declarada no coincide con el comportamiento implementado.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.