Gmail Litiao

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:46 AM UTC
• Version: 1.0.0

Overview

This Gmail skill is mostly coherent, but it gives high-impact mailbox and connection powers and includes unsafe credential troubleshooting guidance.

Review this skill before installing if your Gmail account contains sensitive mail. Use it only when you are comfortable giving Maton API credentials access to the connected mailbox, require explicit review before sending or trashing messages, and avoid running or sharing output from commands that print MATON_API_KEY.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:303

Finding

API Credential Disclosure Through Troubleshooting Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 303–309
Vulnerability Type: Exposure of a bearer API credential in terminal output
Risk Level: Medium

Vulnerable code snippet:

markdown

### Troubleshooting: API Key Issues

1. Check that the `MATON_API_KEY` environment variable is set:

```bash
echo $MATON_API_KEY

text

### Technical Analysis

The troubleshooting instructions tell users or an executing Agent to print the complete `MATON_API_KEY` value to standard output. This bearer credential is used to authenticate requests to Maton services, including the Gmail gateway and connection-management API.

Printing the raw credential violates secret-handling best practices. Terminal output can be retained in shell scrollback, Agent conversation transcripts, CI/CD logs, debugging captures, screen recordings, or support bundles. An attacker who can read any such output may recover the credential without compromising its original storage.

The project does not contain evidence that the command independently transmits the key to an attacker. Exploitation requires another party to obtain the resulting terminal or execution output.

### Attack Path

1. A user experiences an authentication problem and follows the documented troubleshooting procedure.
2. The user or Agent runs `echo $MATON_API_KEY`.
3. The complete bearer credential appears in terminal output.
4. The output is retained in a transcript, log, screenshot, recording, or support artifact.
5. An unauthorized party obtains access to that artifact and extracts the credential.
6. The party presents the credential to Maton APIs.
7. Subject to the credential's server-side permissions and active Gmail connections, the party accesses or manipulates connected Gmail resources.

### Impact Assessment

Successful exploitation may permit impersonation of the Maton account associated with the exposed key. Based on the documented Skill functional
...[truncated 615 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the secret-printing command with a presence-only check:

   bash

   if [ -n "${MATON_API_KEY:-}" ]; then
     echo "MATON_API_KEY is set"
   else
     echo "MATON_API_KEY is not set"
   fi
   

2. If limited diagnostics are necessary, display only a non-sensitive fingerprint derived from the key rather than any portion of the key itself.

3. Explicitly warn users not to include API keys, authorization headers, OAuth session URLs, or raw command output containing credentials in support requests, logs, or screenshots.

4. Recommend immediate API-key revocation and rotation whenever terminal output containing the credential may have been retained or shared.

5. Ensure Agent and CI environments redact MATON_API_KEY and Authorization header values from command output, traces, exception messages, and execution transcripts.

6. Apply least privilege and short credential lifetimes on the server side where supported, and monitor the key for anomalous access following suspected disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises email-sending capability but does not warn that data entered into requests will be transmitted externally to email recipients. In an agent context, this can lead to unintended disclosure of sensitive information if the model composes or sends messages without clear user awareness and consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents destructive Gmail operations such as trashing messages without any warning, confirmation guidance, or discussion of user-data impact. In an agent setting, this increases the risk that an LLM or user triggers irreversible or hard-to-notice mailbox changes without understanding the consequences.

Content

No source excerpt is available for this finding.