Security audit

Gmail No Send

Security checks for vulnerabilities and agentic risk

Overview

This Gmail skill has no send command, but it stores powerful Gmail access and can create drafts or archive mail, so it needs careful review before use.

Treat this as a no-send but not read-only Gmail tool. Install only if you are comfortable granting Gmail draft and message-modification access, protect or revoke the saved token if needed, and require human review before agents create drafts or archive messages.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes capabilities that include network access, reading local secrets (`client_secret.json`), and writing persistent files (`token.json`, `audit.log`), but it does not declare permissions for those actions. Undeclared sensitive capabilities reduce operator visibility and policy enforcement, which is especially important for an OAuth-enabled Gmail tool that handles mailbox content and tokens.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill is presented as a Gmail tool with no send capability and read-only safety properties, but it requests `gmail.compose` and `gmail.modify`, which grant the ability to create drafts and alter mailbox state. Even if the current code does not call send endpoints, these OAuth permissions materially expand what the tool can do if other code is added, abused, or compromised, so the permission model does not match the stated trust boundary.

Intent-Code Divergence

Low

Confidence: 91% confidence
Finding: The comment states that no send endpoints are used, but the requested `gmail.compose` scope still provides broader capabilities than a reader would expect from that comment, including draft creation. This is dangerous because misleading security commentary can cause reviewers and users to underestimate granted privileges and approve the tool under false assumptions.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The documentation states that OAuth tokens are stored at a fixed local path, but it does not clearly warn that refresh tokens can grant ongoing mailbox access and should be treated as highly sensitive credentials. Users may unknowingly leave tokens with weak filesystem protections, increasing the chance of local credential theft or accidental exposure.

Static analysis

No suspicious patterns detected.