Iris Lite — Quick Inbox Scan

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.4

Overview

This Gmail triage skill appears functional and not destructive, but it asks for sensitive mailbox access and uses a risky system-level dependency install without enough privacy and setup guardrails.

Review this carefully before installing. Use only a dedicated Gmail app password you are prepared to revoke, understand that the skill reads message headers and snippets from your inbox, and avoid running the documented pip command in your system Python; use an isolated virtual environment instead. Treat the Pro install and Ko-fi links as advertising for a separate component, not as part of the inbox scan.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:210

Finding

Unconditional Commercial Promotion Injected into Task Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 210-214
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

python

f"[bold yellow]🔓 Want more?[/bold yellow]\n"
f"Iris Pro scans [bold]200 emails[/bold], drafts [bold]every reply[/bold], classifies by category, "
f"and gives you weekly analytics.\n\n"
f"[bold cyan]openclaw skills install iris-pro[/bold cyan]\n"
f"Get your key → [bold]ko-fi.com/s/f75940a0ce[/bold]",

Related promotional instructions also appear at SKILL.md:42-44:

markdown

👉 **Upgrade:** `openclaw skills install iris-pro` — get your key at **ko-fi.com/s/f75940a0ce**

💰 **Bundle deal:** all 5 Pro skills for **$29** → **ko-fi.com/s/7625accf3f** (save $16)

Technical Analysis

The executable workflow unconditionally adds an advertisement, payment link, and command to install another Skill to the result of every inbox scan. This content is not required to perform email triage and alters the agent's task output toward a separate commercial objective.

Because the installation directive is embedded in the generated summary rather than presented as optional metadata, users may interpret it as part of the legitimate workflow. Installing the referenced Skill would introduce additional code and instructions that were outside the scope of this audit.

Attack Path

1. A user invokes the Skill to triage a Gmail inbox.
2. The embedded Python program processes the latest inbox messages.
3. During summary rendering, the program always injects a commercial upgrade message.
4. The message directs the user to run openclaw skills install iris-pro.
5. It also directs the user to an external Ko-fi payment page.
6. If followed, the user installs or purchases an unaudited external component unrelated to completing the current scan.

Impact Assessment

The issue compromises output integrity by mixing task results with man ...[truncated 464 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the installation command and payment link from the generated inbox-scan result.
2. Keep functional output limited to scan statistics, priority results, and requested reply drafts.
3. If product promotion must remain, place it in clearly identified documentation rather than executable output.
4. Make any promotional display explicitly optional and disabled by default.
5. Do not direct users to install another Skill without disclosing that it is a separate, unaudited component with its own permission requirements.
6. Require an explicit user request before presenting external installation or purchase instructions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned Python Dependency Installation Bypasses Environment Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 51
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

pip3 install rich --break-system-packages --quiet

Technical Analysis

The setup command installs rich without a fixed version or cryptographic hash. Consequently, the package and its transitive dependencies are resolved from mutable package-index state at installation time. The reviewed source therefore does not fully determine which dependency code a user will receive.

The --break-system-packages option bypasses Python's externally managed environment protection. This can allow pip to alter an interpreter environment managed by the operating system, potentially causing package conflicts or replacing components expected by other applications.

The --quiet option additionally suppresses useful installation information, making dependency changes and warnings less visible. No evidence was found that the named rich package is intentionally malicious; the risk arises from mutable dependency resolution and the unnecessary environment-safeguard bypass.

Attack Path

1. A user follows the documented installation step.
2. pip3 queries its configured package index and resolves the latest available rich package and applicable dependencies.
3. The installed artifacts may differ from those reviewed by the Skill author because no versions or hashes are specified.
4. The --break-system-packages flag allows installation into an externally managed Python environment when filesystem permissions permit it.
5. Package installation or later import executes dependency code with the privileges of the user running the command.
6. A compromised upstream release, compromised package index, or unsafe index configuration could therefore execute code or modify the Python environment.

Impact Assessment

Successful exploitation of the dependency supply c ...[truncated 657 chars]

Remediation

View remediation

Remediation Suggestions

1. Create and use an isolated virtual environment instead of modifying the system-managed interpreter.

2. Remove --break-system-packages.

3. Pin rich and every transitive dependency to reviewed versions.

4. Use a requirements lock file containing cryptographic hashes and install with pip install --require-hashes.

5. Retain normal pip output or logging so users can inspect resolved packages and security warnings.

6. Use a trusted, explicitly configured package index and periodically review dependency advisories.

7. Example hardened installation approach:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   python3 -m pip install --require-hashes -r requirements.txt
   

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires a Gmail address and Gmail app password, then reads inbox metadata and message snippets from the user's mailbox, but it does not present any clear privacy notice, data-handling disclosure, retention statement, or warning about the sensitivity of mailbox contents and credentials. Even though the code appears to use the credentials locally for direct IMAP access rather than exfiltrating them, users are asked to expose highly sensitive account access without adequate informed consent or guardrails.

Content

No source excerpt is available for this finding.