maverick-gog

• Outcome: Review
• Latest audit: Oct 29, 2026 · 4:59 PM UTC
• Version: 1.0.2

Overview

This skill provisions Google credentials as described, with disclosed storage risks that require careful deployment configuration.

Use with a trusted provisioning service and grant only the Google permissions you need. Set a strong, nonempty GOG_KEYRING_PASSWORD consistently for setup and runtime, and protect credential files and backups. The documented client-secret file remains plaintext even when the token keyring has a password.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-gog-oauth.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# Read env-supplied OAuth credentials, write to gogcli's local stores.
# - Client creds (id+secret) → $XDG_CONFIG_HOME/gogcli/credentials-$MAVERICK_GOG_CLIENT.json (plaintext, 0600)
# - Refresh token → $XDG_CONFIG_HOME/gogcli/keyring/ (file backend, jose2go-encrypted
#   under GOG_KEYRING_PASSWORD), keyed by (client=$MAVERICK_GOG_CLIENT, email=$MAVERICK_GOG_EMAIL)
#
# MAVERICK_GOG_CLIENT is the client name of the persisted state, not of the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 19)May include surrounding context.

sh

: "${SKILL_DIR:?setup environment should export SKILL_DIR}"

# gogcli's file keyring distinguishes "unset" from "set to empty string":
# unset + non-TTY = hard error (errNoTTY); set (any value, including "") =
# silent (FixedStringPrompt). Verified at internal/secrets/store.go
# fileKeyringPasswordFuncFrom.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-gog-oauth.sh (reported line 5)May include surrounding context.

sh

# Read env-supplied OAuth credentials, write to gogcli's local stores.
# - Client creds (id+secret) → $XDG_CONFIG_HOME/gogcli/credentials-$MAVERICK_GOG_CLIENT.json (plaintext, 0600)
# - Refresh token → $XDG_CONFIG_HOME/gogcli/keyring/ (file backend, jose2go-encrypted
#   under GOG_KEYRING_PASSWORD), keyed by (client=$MAVERICK_GOG_CLIENT, email=$MAVERICK_GOG_EMAIL)
#
# MAVERICK_GOG_CLIENT is the client name of the persisted state, not of the
# gateway generation: the orchestrator keeps it across every gateway the state

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 9)May include surrounding context.

sh

# install and on credential rotation. The harness runs `bash setup.sh` with
# cwd set to the skill directory and SKILL_DIR exported.
#
# Thin delegator: enforces SKILL_DIR + the GOG_KEYRING_PASSWORD env-state
# contract, then delegates to init-gog-oauth.sh. Setup-hook env must provide:
# bash, jq, gog (>= v0.17.0). Of these, only `gog` is in SKILL.md
# `requires.bins` (the field gates agent-runtime eligibility; `gog` is needed

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-gog-oauth.sh (reported line 13)May include surrounding context.

sh

# arrives with the setup call itself, never from the container's boot env, so a
# container started before the name existed still seeds under it.
#
# Security boundary: GOG_KEYRING_PASSWORD encrypts the refresh-token keyring
# only. The client-creds file lands plaintext on disk, protected by the
# container filesystem and the R2 access boundary alone, until gogcli encrypts
# it upstream.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-gog-oauth.sh (reported line 13)May include surrounding context.

sh

# arrives with the setup call itself, never from the container's boot env, so a
# container started before the name existed still seeds under it.
#
# Security boundary: GOG_KEYRING_PASSWORD encrypts the refresh-token keyring
# only. The client-creds file lands plaintext on disk, protected by the
# container filesystem and the R2 access boundary alone, until gogcli encrypts
# it upstream.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-gog-oauth.sh (reported line 18)May include surrounding context.

sh

# container filesystem and the R2 access boundary alone, until gogcli encrypts
# it upstream.
#
# GOG_KEYRING_BACKEND is pinned to `file` as an image-level constant in
# infra/openclaw/image/Dockerfile, so a future base image that introduces dbus
# cannot make gogcli's `auto` resolution attempt SecretService and pay its 10s
# cold-call timeout.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-gog-oauth.sh (reported line 33)May include surrounding context.

sh

# not merely "callback succeeded". Google omits refresh_token from refresh-flow
# responses and may omit it from authorization-code responses for
# previously-consented users, and re-firing with a stale token clobbers a
# refresh that gogcli rotated in-keyring, breaking the integration until
# re-authorization. Mirrors mcporter init-mcporter-oauth.sh § Re-run policy.

set -eu

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-gog-oauth.sh (reported line 47)May include surrounding context.

sh

# Tokens via env (not argv) to keep them out of /proc/<pid>/cmdline.
# Envelope shape is required by gogcli's parser (ParseGoogleOAuthClientJSON
# accepts {installed:{...}} or {web:{...}} only); only client_id +
# client_secret are extracted — other Google client_secret.json fields are
# accepted but ignored. On disk gogcli stores the flat {client_id,
# client_secret} pair regardless of input envelope. We use {web:{...}} to
# match the typical Google Cloud "Web application" OAuth client type used

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 22)May include surrounding context.

sh

# gogcli's file keyring distinguishes "unset" from "set to empty string":
# unset + non-TTY = hard error (errNoTTY); set (any value, including "") =
# silent (FixedStringPrompt). Verified at internal/secrets/store.go
# fileKeyringPasswordFuncFrom.
#
# Refuse setup if the env var is truly unset — the deployment must expose it
# (any value, including empty) so it reaches both the setup subprocess AND

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The validation rejects an unset password but deliberately accepts an empty one, allowing provisioning without meaningful password-based protection of refresh tokens. An attacker who obtains the token-store files or a backup in that configuration could recover long-lived credentials and access Google Workspace data within their granted scopes.

Content

Scanner excerpt · scripts/setup.sh (reported line 28)May include surrounding context.

sh

# (any value, including empty) so it reaches both the setup subprocess AND
# every later agent-runtime `gog ...` call. Normalizing here would only fix
# the setup subprocess; the agent would still hit errNoTTY on first API call.
if [ -z "${GOG_KEYRING_PASSWORD+x}" ]; then
  echo "setup.sh: ERROR — GOG_KEYRING_PASSWORD must be set in the container env (any value, including empty)." >&2
  echo "setup.sh:   Setting it only for this subprocess would leave the agent runtime broken on first \`gog\` call." >&2
  echo "setup.sh:   Empty string is acceptable (no at-rest crypto). A real per-instance passphrase is recommended." >&2

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The diagnostic explicitly endorses an empty password, reflecting the same insecure acceptance policy as the preceding validation rather than leaking a password itself. Following this guidance leaves refresh-token storage without meaningful password protection if the store is subsequently copied or exposed.

Content

Scanner excerpt · scripts/setup.sh (reported line 29)May include surrounding context.

sh

# every later agent-runtime `gog ...` call. Normalizing here would only fix
# the setup subprocess; the agent would still hit errNoTTY on first API call.
if [ -z "${GOG_KEYRING_PASSWORD+x}" ]; then
  echo "setup.sh: ERROR — GOG_KEYRING_PASSWORD must be set in the container env (any value, including empty)." >&2
  echo "setup.sh:   Setting it only for this subprocess would leave the agent runtime broken on first \`gog\` call." >&2
  echo "setup.sh:   Empty string is acceptable (no at-rest crypto). A real per-instance passphrase is recommended." >&2
  exit 1

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The script detects an empty keyring password but only emits a warning and then continues into credential provisioning. This is the same fail-open protection issue as the earlier validation: a copied token store can expose long-lived Google credentials without a secret password barrier.

Content

Scanner excerpt · scripts/setup.sh (reported line 35)May include surrounding context.

sh

exit 1
fi

if [ -z "${GOG_KEYRING_PASSWORD}" ]; then
  echo "setup.sh: WARNING — GOG_KEYRING_PASSWORD is empty (no at-rest crypto)." >&2
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The warning does not print any secret, but it accompanies continued setup after detecting the absence of meaningful at-rest password protection. This duplicates the empty-password policy issue rather than representing a separate credential-exfiltration mechanism.

Content

Scanner excerpt · scripts/setup.sh (reported line 36)May include surrounding context.

sh

fi

if [ -z "${GOG_KEYRING_PASSWORD}" ]; then
  echo "setup.sh: WARNING — GOG_KEYRING_PASSWORD is empty (no at-rest crypto)." >&2
fi

bash "${SKILL_DIR}/scripts/init-gog-oauth.sh"

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

# maverick-gog

Internal setup hook for the `gog` CLI ([`openclaw/gogcli`](https://github.com/openclaw/gogcli)). Provisions gogcli's OAuth state from env vars supplied by an external orchestrator over the OpenClaw `skills.setup` RPC. After setup completes, agents use Google Workspace via the upstream [`gog` skill](https://github.com/openclaw/openclaw/blob/main/skills/gog/SKILL.md) — this skill provides no agent-facing commands.

## Provides

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/init-gog-oauth.sh:40