ClawHub
Back to skill

Security audit

Mail Agent

Security checks for vulnerabilities and agentic risk

Overview

The plugin largely does what it claims, but it handles private Gmail content, external AI classification, Telegram forwarding, and remote installation with weaker disclosure and scoping than users should accept without review.

Install only after confirming you are comfortable with private Gmail metadata and snippets being sent to Telegram and, if llmApiKey is set, to the configured LLM provider. Avoid custom llmBaseUrl values unless you fully trust and control the endpoint, use a dedicated low-privilege Google Cloud project, secure OpenClaw plugin config because it stores the LLM key, and verify the downloaded plugin source or digest before following the GitHub archive install command.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
index.ts:37
Finding

Configurable LLM Endpoint Can Exfiltrate Email Content and API Credentials

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:89
Finding

Executable Plugin Is Retrieved from a Mutable External Archive Without Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sets up forwarding of email-derived information to Telegram and optionally to an external LLM service for classification, but it does not prominently warn the user that potentially sensitive mailbox content and metadata may leave Gmail and be transmitted to third parties. In the context of an email-monitoring skill, this omission is especially dangerous because inbox data commonly contains personal, financial, legal, or corporate secrets.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

If no accounts are listed, stop and tell the user to set up gog first:

bash
gog auth credentials /path/to/client_secret.json
gog auth add you@gmail.com --services gmail

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The configurable llmBaseUrl allows full email-derived content to be sent to an arbitrary endpoint, not just a fixed known provider. That materially increases exfiltration risk because a malicious or compromised configuration can redirect private inbox data to attacker-controlled infrastructure under the guise of classification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that inbox contents are classified by an external LLM and important messages are forwarded to Telegram, but it does not clearly warn users that potentially sensitive mailbox data may leave Gmail and be disclosed to third-party services. This creates a real privacy and compliance risk because users may enable the plugin without understanding that personal, confidential, or regulated email content could be transmitted externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The configuration steps instruct users to provide an LLM API key, which operationally enables external processing of mailbox data, but the README does not warn that this may transmit email contents to a third-party API for classification. In the context of an email-monitoring plugin, that omission is security-relevant because it can lead to unintentional exfiltration of sensitive communications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to perform network-capable actions such as installing a remote plugin, authenticating with Google Cloud, enabling APIs, and configuring external integrations, but it declares no explicit tool scope or allowed-tools metadata. This creates an authorization gap where a broadly invoked skill could perform sensitive network actions without clear least-privilege boundaries or user-visible permission constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation description is broad enough to match common setup or troubleshooting requests around email notifications, Gmail monitoring, or missing alerts, which can cause the skill to activate in situations beyond a tightly intended scope. Because the skill then walks through cloud auth, plugin installation, and service configuration, overbroad triggering increases the chance of unintended sensitive changes to a user's environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends sender, subject, and up to 500 characters of email body to an external LLM for classification, which exceeds the core Gmail-to-Telegram forwarding behavior described to the user. This creates a real data disclosure risk because potentially sensitive inbox content is transmitted to a third party without any visible consent or clear necessity in this file.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The file performs external transmission to an API endpoint using inbox-derived content. In this skill's context, external transmission is security-relevant because the transmitted data originates from private email and is sent outside the primary mail monitoring channel described to the user.

Content

Scanner excerpt · index.ts (reported line 37)May include surrounding context.

ts
return { important: true, summary: subject };
  }

  const baseUrl = cfg.llmBaseUrl ?? "https://api.openai.com/v1";
  const model = cfg.llmModel ?? "gpt-4o-mini";

  try {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code transmits email content to an external LLM service without any visible user-facing warning, consent flow, or in-file disclosure. Even if intended for triage, this is dangerous because inbox contents often include personal, financial, or confidential data that users may not expect to leave Google's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill forwards sender, subject, and summary to Telegram, which is an external messaging platform, without any visible warning or confirmation in this file. This is a real privacy risk because email metadata and derived content may be sensitive, and Telegram chats can be accessible across devices or by unintended recipients if misconfigured.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

md
"llmBaseUrl": {
        "type": "string",
        "description": "LLM API base URL",
        "default": "https://api.openai.com/v1"
      },
      "llmModel": {
        "type": "string",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · openclaw.plugin.json (reported line 33)May include surrounding context.

json
"llmBaseUrl": {
        "type": "string",
        "description": "LLM API base URL",
        "default": "https://api.openai.com/v1"
      },
      "llmModel": {
        "type": "string",

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The system prompt instructs the model to always produce the summary in the same language as the email, imposing a language behavior automatically. There is no indication in this file that the user can choose or opt into that locale/language handling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The inline comments segment the logic as 'Register Gmail watch' and later 'Subscribe to Pub/Sub'; however, the service's operational behavior depends on both watch registration and active Pub/Sub message consumption. While not severe, the documentation framing understates that the component is also a long-lived subscriber processing inbound Pub/Sub events.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.