Openclaw Email Orientation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.1

Overview

This is a mostly transparent email and calendar guide, but it asks users to authorize broad owner Google Workspace access beyond the documented workflows.

Install only if you need an OpenClaw guide for gog-based Gmail and Calendar setup. When following it, authorize only the services needed for the immediate task, prefer a separate agent account with shared resources, avoid granting Drive/Docs/Sheets/Contacts unless required, and revoke unused Google permissions afterward.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:51

Finding

Overbroad Google Workspace OAuth Authorization Exceeds Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 51
Vulnerability Type: Excessive OAuth scopes and privilege escalation
Risk Level: High

Vulnerable Code Snippet:

bash

# Add an account (opens browser for OAuth flow)
gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs

Technical Analysis

The setup command instructs users to authenticate the owner's Google account and authorize access to Gmail, Calendar, Drive, Contacts, Sheets, and Docs. The demonstrated email and calendar workflows do not require all these services. In particular, Drive, Contacts, Sheets, and Docs exceed the minimum privileges necessary for the documented Gmail and Calendar examples.

This broad authorization increases the authority associated with the resulting OAuth token. It also weakens the separation described elsewhere in the skill between the owner's account and the agent's account. The safer model is to authenticate the agent account where possible, share only the required owner resources with that account, and request service access separately according to the immediate operation.

The documented credential path, ~/.openclaw/.gog/credentials.json, is not itself evidence of credential theft. The skill explicitly states that credential-file contents must not be displayed. The security issue is the breadth of the requested authorization rather than merely documenting where credentials are stored.

Attack Path

1. A user follows the skill's setup instructions and executes the provided gog auth add command.
2. The owner completes the OAuth flow and grants all requested service permissions.
3. gog receives authorization covering Gmail, Calendar, Drive, Contacts, Sheets, and Docs, including services not needed for the immediate email or calendar task.
4. If the resulting token, local account state, or authorized gog environment is later compromised or misused, the attacker can o ...[truncated 1106 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the broad setup command with service-specific authorization:

   bash

   # Email-only workflow
   gog auth add [e-mail] --services gmail
   
   # Calendar-only workflow
   gog auth add [e-mail] --services calendar
   
   # Combined email and calendar workflow
   gog auth add [e-mail] --services gmail,calendar
   

2. Do not request Drive, Contacts, Sheets, or Docs unless a user explicitly invokes functionality that requires those services.

3. Prefer authenticating the separate agent account and sharing only the required mailbox or calendar resources rather than broadly authenticating as the owner.

4. For calendar workflows, grant only the required calendar permission. Use read-only access for viewing tasks and grant “Make changes to events” only when event creation or modification is necessary.

5. Clearly separate setup instructions by capability and state the data and operations enabled by each requested service before the user authorizes it.

6. Document a revocation procedure and advise users to remove unused accounts or permissions after the task is complete.

7. Preserve the existing rule against printing credential-file contents, and additionally recommend restrictive filesystem permissions and secure local credential storage.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The skill discloses the exact filesystem path of a credential store containing OAuth client credentials. Even though it says not to print contents, exposing sensitive file locations can materially aid follow-on attacks, prompt-injection attempts, or unauthorized local credential harvesting by telling an agent exactly where secrets reside.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

| File | Purpose |
|---|---|
| `~/.openclaw/.gog/credentials.json` | gog OAuth client credentials |
| `~/.openclaw/agents/main/agent/auth-profiles.json` | OpenClaw auth profiles |
| `~/.openclaw/workspace/skills/gog/SKILL.md` | gog usage reference |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

bash

# One-time setup: load OAuth credentials
gog auth credentials /path/to/client_secret.json

# Add an account (opens browser for OAuth flow)
gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

|---|---|
| `~/.openclaw/.gog/credentials.json` | gog OAuth client credentials |
| `~/.openclaw/agents/main/agent/auth-profiles.json` | OpenClaw auth profiles |
| `~/.openclaw/workspace/skills/gog/SKILL.md` | gog usage reference |

**Security rule:** Never show the contents of these files in chat. Mentioning the path is fine; printing the content is not.

Static analysis

No suspicious patterns detected.