T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:31- Finding
Google OAuth Tokens Stored in an Unprotected Plaintext File
- Content
View full analysis
- Remediation
View remediation
Security audit
Edsby Grades Board
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its stated Edsby-to-Google-Calendar purpose, but it handles sensitive school data and account credentials with too little user control and protection.
Review before installing. Use a dedicated Google Calendar instead of the primary calendar, grant the least Google OAuth scope possible, keep google-tokens.json and the Edsby browser profile out of shared folders and source control, and avoid scheduled or repeated sync until the skill has confirmation, duplicate prevention, and secure credential storage.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:8- Finding
Persistent Edsby Browser Session Stored Without Explicit Access Controls
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
package.json:6- Finding
Non-Reproducible Installation of Security-Sensitive Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly performs Google Calendar synchronization and scheduled checks, which can cause ongoing automated modifications to an external user data store. Because the description does not clearly state consent, scope of changes, frequency, or safeguards such as confirmation and dry-run behavior, users may be surprised by persistent calendar edits, duplicate events, or unintended disclosure of school-related schedule information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill retrieves sensitive educational records including classes, grades, and assignments from Edsby, but the executable path contains no user-facing notice or consent mechanism. Because this data is highly personal and potentially regulated student information, silent collection increases privacy risk and the chance of misuse by downstream tools or prompts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill can create Google Calendar events from Edsby assignment data, which is an external side effect involving a third-party account. Even if this is arguably feature-related, the code provides no in-tool justification, consent gate, or scope limitation, so a user may trigger calendar modification without clearly understanding that student data will be exported and written externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code writes calendar events to Google Calendar without preview, confirmation, or any user-visible warning. This is dangerous because it transfers assignment details to an external service and modifies user data stores, which can cause privacy leakage, unwanted changes, or event spam if inputs are malformed or repeated.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The daily check tool appears to be a simple assignment check, but it also performs calendar synchronization as a hidden side effect. This increases risk because a user or calling agent may invoke a benign-sounding tool and unintentionally cause external writes and data transfer to Google.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The daily check tool triggers calendar synchronization as a side effect with no direct warning in that execution flow. Hidden side effects are especially risky in agent environments because a scheduler or higher-level agent may repeatedly invoke the tool, causing ongoing disclosure of assignment data and repeated modifications to the user's calendar.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency uses a caret range (^1.41.0), which permits automatic installation of newer compatible releases rather than a single audited version. In a security-sensitive skill that uses browser automation, this weakens supply-chain control and can unexpectedly introduce vulnerable or malicious upstream changes.
- Content
json "description": "OpenClaw skill for Edsby student data and Google Calendar sync", "main": "index.js", "dependencies": { "playwright": "^1.41.0", "googleapis": "^128.0.0" }, "scripts": {
Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 74% confidence
- Finding
Playwright has a referenced advisory, and because the manifest does not pin an exact version, it is not possible to verify whether deployed installations avoid the affected release(s). This is more concerning here because Playwright can download and manage browser binaries, expanding supply-chain exposure in an automation-focused skill.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The googleapis dependency is also specified with a caret range (^128.0.0), so installs may resolve to different versions over time. For a skill handling student data and Google Calendar access, unpinned dependencies increase supply-chain and reproducibility risk.
- Content
json "main": "index.js", "dependencies": { "playwright": "^1.41.0", "googleapis": "^128.0.0" }, "scripts": { "auth": "node index.js --auth"
Unverifiable Dependency: googleapis has 1 known advisory(ies) (GHSA-7543-mr7h-6v86 (Improper Authorization in googleapis)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 72% confidence
- Finding
The manifest includes googleapis with an unpinned version while a known advisory exists for the package, making it impossible to confirm that installations are on a fixed release. Because this skill is intended to sync student data and Google Calendar, any authorization weakness in the API client can have direct consequences for sensitive data access and calendar operations.
- Content
Static analysis
No suspicious patterns detected.