Security audit

Calendar Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill is a calendar setup guide, but it tells agents to use broad Google Workspace permissions and manually handle owner OAuth credentials.

Install only if you are comfortable granting owner-level Google Workspace authority. Prefer calendar-only OAuth scopes, avoid the direct credential-file workaround, do not expose refresh tokens or client secrets to agent context, and remove deployment-specific account/path details before reuse.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:192
Finding: Direct Extraction and Use of Reusable Owner OAuth Credentials
Content: View full analysis
" \ -d "client_secret=" \ -d "refresh_token=" \ -d "grant_type=refresh_token" # → get access_token from response # 3. Call Calendar API directly curl -s "https://www.googleapis.com/calendar/v3/calendars/netanelab%40monday.com/events?timeMin=&timeMax=&singleEvents=true&orderBy=startTime&maxResults=10" \ -H "Authorization: Bearer $ACCESS_TOKEN" # 4. List all calendars curl -s "https://www.googleapis.com/calendar/v3/users/me/calendarList" \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` **Note:** `~/.config/gws/credentials.json` (gog default path) has a stale/broken token. Always use `/opt/ocana/openclaw/.gog/credentials.json`. ``` ### Technical Analysis The Skill instructs the agent to open a deployment-specific credential file and extract an OAuth client secret and owner refresh token. A refresh token is long-lived reusable authentication material that can be exchanged for access tokens without repeating interactive owner authorization. This bypasses the safer abstraction provided by a credential manager or authenticated CLI. It unnecessarily exposes raw credentials to the agent context and command workflow, where they may be disclosed through generated commands, process inspection, shell history, diagnostic output, logs, or chat responses. ...[truncated 1480 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:49
Finding: Calendar Setup Requests Excessive Google Workspace Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:192
Finding: Deployment-Specific Secret Location and Account Identities Embedded in Reusable Skill
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The instruction to use /opt/ocana/openclaw/.gog/credentials.json explicitly directs access to a sensitive credential store. This materially increases risk because it normalizes reading secrets from disk for operational convenience, enabling privilege abuse and lateral access to owner data.
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
Heleni-specific: Direct API Workaround (when gog CLI auth fails)

gog auth login requires a browser — doesn't work on a server. Use the pre-existing credentials in /opt/ocana/openclaw/.gog/credentials.json instead.

bash
# 1. Read client_id, client_secret, refresh_token from the file (owner account)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly tells the operator to use pre-existing OAuth credentials from a local file, including refresh tokens, to access the owner's Google data. This is highly sensitive because anyone following the instructions can convert stored long-lived credentials into active access tokens and operate on the owner's account outside normal consent and tooling safeguards.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directs the user to extract stored OAuth credentials and refresh tokens from a local file and use them to access Google APIs directly. This is a textbook secret-disclosure and abuse pathway because it enables unauthorized reuse of privileged credentials outside intended application boundaries.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The skill explicitly instructs reading client_id, client_secret, and refresh_token from a file to refresh access. This is direct credential access guidance that can immediately enable impersonation of the owner account and persistent access to Google services.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
# 1. Read client_id, client_secret, refresh_token from the file (owner account) # Accounts: "agent" (genesis@ocana.ai), "owner" (netanelab@monday.com) # 2. Refresh access token curl -s -X POST https://oauth2.googleapis.com/token \ -d "client_id=<client_id>" \ -d "client_secret=<client_secret>" \

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The note that one credentials file is stale and operators should 'always use' another credential store actively steers users toward a sensitive secret source. This is dangerous because it operationalizes secret retrieval and encourages repeated dependence on long-lived credentials outside a controlled auth process.
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
-H "Authorization: Bearer $ACCESS_TOKEN"

text
**Note:** `~/.config/gws/credentials.json` (gog default path) has a stale/broken token. Always use `/opt/ocana/openclaw/.gog/credentials.json`. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.
md
| File | Purpose | |---|---| | `~/.openclaw/.gog/credentials.json` | gog OAuth client credentials | | `~/.openclaw/agents/main/agent/auth-profiles.json` | OpenClaw auth profiles | | `skills/gog/SKILL.md` | gog usage reference |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.
bash
# One-time: load OAuth credentials gog auth credentials /path/to/client_secret.json # Add an owner account (opens browser for OAuth) gog auth add owner@company.com --services gmail,calendar,drive,contacts,sheets,docs

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions authenticate gmail, drive, and contacts in addition to calendar for a task whose stated purpose is calendar setup. Overbroad OAuth scope requests violate least privilege and unnecessarily expose sensitive mail, files, and contacts if the agent or environment is compromised.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
--from $(date -u +%Y-%m-%dT%H:%M:%SZ) \ --to $(date -u -d '+7 days' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v+7d +%Y-%m-%dT%H:%M:%SZ) # Create event with attendee GOG_ACCOUNT=owner@company.com gog calendar create primary \ --summary "Meeting title" \ --start "2026-04-02T10:00:00+00:00" \

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The direct API workaround instructs operators to bypass the normal CLI flow and manually handle OAuth refresh tokens and raw API calls. That materially broadens the skill from setup guidance into credential handling and direct privileged API access, increasing the chance of secret exposure and unauthorized use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The procedure has the operator handle client_secret, refresh_token, and access tokens directly, but it does not prominently warn about the sensitivity of those secrets or prohibit copying, logging, or sharing them. In practice this raises the risk of credential leakage through terminal history, chat transcripts, logs, and screenshots.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The skill instructs transmitting OAuth client credentials and a refresh token to Google's token endpoint to mint an access token. While the endpoint is legitimate, the dangerous part is encouraging raw secret handling and network transmission of reusable credentials, which can be exposed through logs, shell history, process inspection, or operational mistakes.
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
# Accounts: "agent" (genesis@ocana.ai), "owner" (netanelab@monday.com) # 2. Refresh access token curl -s -X POST https://oauth2.googleapis.com/token \ -d "client_id=<client_id>" \ -d "client_secret=<client_secret>" \ -d "refresh_token=<refresh_token>" \

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims to be a calendar-setup wizard but expands into broad email, drive, contacts, docs, and sheets access guidance. This increases the effective permission scope and operational capability far beyond the stated purpose, making accidental over-authorization and misuse of the owner's Google Workspace data more likely.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.
md
|---|---| | `~/.openclaw/.gog/credentials.json` | gog OAuth client credentials | | `~/.openclaw/agents/main/agent/auth-profiles.json` | OpenClaw auth profiles | | `skills/gog/SKILL.md` | gog usage reference | **Security:** Never print the contents of these files in chat. Path is fine; content is not.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The markdown instructs the operator to create and later delete a test event in the owner's calendar, which directly modifies user data. While the steps mention deleting the test event afterward, they do not clearly warn the user in advance that the procedure will temporarily create and remove calendar data in the owner's account.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Heleni-specific: Direct API Workaround (when gog CLI auth fails)

Context-Inappropriate Capability

Ssd 3

Credential Access

Credential Access

Credential Access

Credential Access

Description-Behavior Mismatch

Session Persistence

Description-Behavior Mismatch

Missing User Warnings

External Transmission

Description-Behavior Mismatch

Skill Enumeration

Missing User Warnings

Static analysis