T09 · Insecure Skill Coding Practices
Error
- Location
scripts/triage-and-draft.sh:5- Finding
Hardcoded Default Keyring Password Protects Gmail Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Gmail Secretary
Security checks for vulnerabilities and agentic risk
Overview
This Gmail assistant mostly matches its stated purpose, but it embeds a default keyring password and publishes/persists sensitive mailbox-derived content in ways users should review before installing.
Install only after replacing the hardcoded account and keyring password handling, deleting the packaged personal voice reference, adding clear consent for LLM processing of email summaries, using restrictive permissions and cleanup for Gmail caches, and requiring review before labels are applied.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apply-labels.sh:7- Finding
JavaScript Code Injection Through GOG_ACCOUNT
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:18- Finding
Unredacted Email Metadata and Snippets Are Routed to an External LLM Workflow
- Content
View full analysis
{ function pick(o,ks){for(const k of ks){if(o&&o[k]!=null)return o[k]}return null} function hdr(o,n){const hs=o?.payload?.headers||o?.headers;if(Array.isArray(hs)){const h=hs.find(x=>(x?.name||'').toLowerCase()===n.toLowerCase());return h?.value||null}return null} const subj=hdr(m,'Subject')||pick(m,['subject'])||'(no subject)'; const from=hdr(m,'From')||pick(m,['from'])||'(unknown)'; const snip=(pick(m,['snippet','text','preview'])||'').replace(/\s+/g,' ').trim().slice(0,200); const id=pick(m,['id','messageId'])||''; const threadId=pick(m,['threadId'])||id; const date=hdr(m,'Date')||pick(m,['date','internalDate'])||''; return {i,id,threadId,subj,from,snip,date}; }); fs.writeFileSync('/home/delta/.openclaw/workspace/cache/gmail-inbox-summaries.json',JSON.stringify(out,null,2)); console.log('Extracted '+out.length+' email summaries'); " ``` ### Technical Analysis The declared workflow instructs a Haiku LLM agent to read the generated summary file. Each record contains the sender, full subject, up to 200 characters of message t ...[truncated 2029 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/triage-and-draft.sh:9- Finding
Sensitive Gmail Content Is Persisted in Predictable Files Without Explicit Access Controls
- Content
View full analysis
"$INBOX_CACHE" ``` ```javascript fs.writeFileSync('/home/delta/.openclaw/workspace/cache/gmail-inbox-summaries.json',JSON.stringify(out,null,2)); ``` ```javascript // Redact common personal identifiers sn = sn .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/ig,'[email]') .replace(/\b\+?1?[-. (]*\d{3}[-. )]*\d{3}[-. ]*\d{4}\b/g,'[phone]') .replace(/\bLinkedIn\b/ig,'[link]'); if (!sn) continue; samples.push({subject,to,date,snippet:sn.slice(0,600)}); ``` ```javascript lines.push('## Representative micro-snippets (snippets only)'); for (const s of samples.slice(0,15)){ lines.push(`- “${s.snippet.slice(0,220)}${s.snippet.length>220?'…':''}”`); } fs.writeFileSync(process.env.OUT, lines.join('\n')+'\n'); ``` The generated artifact confirms incomplete redaction: ```markdown - “Dear Robin, I just called Certiphi support, and they said the only way to bypass this would be to put on the form that I already graduated...” - “Dear FAU College of Medicine Admissions Office, Thank you so much for the opportunity to be a part of this program!...” ``` ### Technical Analysis The scripts persist raw inbox search output, extracted summaries, and representative sent-mail snippets in fixed workspace locations. They do not set a restrictive `umask`, explicitly set file permissions, encrypt the files, establish deletion periods, or remove the raw and summary caches after classification. File modes therefore depend on ...[truncated 1969 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This mismatch indicates undocumented local export/caching of inbox-derived data while the stated purpose emphasizes classification, labels, and draft replies. Hidden or under-described caching is particularly risky in a Gmail assistant because inbox summaries, labels, and related artifacts may contain sensitive personal, academic, financial, or account-security information that could be exposed or retained longer than intended.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This mismatch indicates undocumented local export/caching of inbox-derived data while the stated purpose emphasizes classification, labels, and draft replies. Hidden or under-described caching is particularly risky in a Gmail assistant because inbox summaries, labels, and related artifacts may contain sensitive personal, academic, financial, or account-security information that could be exposed or retained longer than intended.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/apply-labels.sh` reads classification results and applies Gmail labels via `gog`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/apply-labels.sh` reads classification results and applies Gmail labels via `gog`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/apply-labels.sh` reads classification results and applies Gmail labels via `gog`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/build-voice-reference.sh` (samples last 50 sent messages)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The KEYRING finding is a true issue because the script hardcodes a default keyring password and exports it into the environment, creating credential exposure and potential unauthorized access to stored Gmail-related secrets. In this skill context, the danger is elevated because the credential protects an email automation account, which could expose private communications and enable further mailbox manipulation.
- Content
sh set -euo pipefail ACCOUNT="${GOG_ACCOUNT:-alan.alwakeel@gmail.com}" export GOG_KEYRING_PASSWORD="${GOG_KEYRING_PASSWORD:-openclaw}" LABELS_FILE="/home/delta/.openclaw/workspace/cache/gmail-triage-labels.json" if [ ! -f "$LABELS_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The script hardcodes a default keyring password ('openclaw') into an environment variable, which effectively embeds credential material in code and enables unauthorized access wherever the same keyring configuration is used. Default secrets are especially dangerous because they are predictable, easily reused, and may grant access without any user interaction.
- Content
sh #!/usr/bin/env bash set -euo pipefail export GOG_KEYRING_PASSWORD="${GOG_KEYRING_PASSWORD:-openclaw}" OUT_DIR="/home/delta/.openclaw/workspace/skills/gmail-secretary/references" OUT="$OUT_DIR/voice.md"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This repeats the same insecure behavior by exporting a predictable default keyring password later in the script, reinforcing reliance on embedded credentials. Repetition increases the chance the script runs successfully with the unsafe default and normalizes insecure secret handling across environments.
- Content
sh mkdir -p "$OUT_DIR" ACCOUNT="${GOG_ACCOUNT:-alan.alwakeel@gmail.com}" export GOG_KEYRING_PASSWORD="${GOG_KEYRING_PASSWORD:-openclaw}" TMP_IDS=$(mktemp) trap 'rm -f "$TMP_IDS"' EXIT
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The embedded Node code fetches full email bodies using 'gog gmail get --format=full' and stores excerpts in a persistent markdown file. Pulling complete message content magnifies exposure because redaction is incomplete and snippets can still contain confidential business context, names, schedules, or other sensitive content that becomes easier to exfiltrate from disk than from Gmail directly.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
Exporting a default keyring password in the environment constitutes embedded credential material and can enable credential access by anyone who can read the script, process environment, or inherited subprocess state. In the context of a Gmail triage skill, this is especially dangerous because it can unlock mailbox access and facilitate broader account compromise.
- Content
sh set -euo pipefail ACCOUNT="${GOG_ACCOUNT:-alan.alwakeel@gmail.com}" export GOG_KEYRING_PASSWORD="${GOG_KEYRING_PASSWORD:-openclaw}" VOICE_REF="/home/delta/.openclaw/workspace/skills/gmail-secretary/references/voice.md" OUT_TRIAGE="/home/delta/.openclaw/workspace/cache/gmail-triage.md"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares operational behavior involving Gmail access, local file writes, and environment-backed tooling (
gog, agent scripts), but does not declare any explicit tool scope or permissions boundary. That makes the effective access level ambiguous and increases the risk of over-privileged execution, especially for a skill that processes sensitive email content and writes artifacts to local cache paths.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script exports a hardcoded default keyring password via GOG_KEYRING_PASSWORD, which embeds a credential-like secret directly in code and makes it available to child processes. Anyone with access to the script, environment, logs, or process context may recover or reuse this secret to access the gog keyring, so this is more than a missing warning issue in the context of a Gmail automation skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The script invokes the external gog CLI to create labels and modify Gmail threads, which changes user data in an external service. Although the file comments mention applying labels, there is no runtime disclosure, confirmation, or cautionary notice before performing these write operations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script enumerates recent sent Gmail messages, fetches full message contents, derives snippets, and persists them to a local reference file. Even though some redaction is attempted, this creates a secondary datastore of sensitive communication content that exceeds a narrow 'triage assistant' purpose and increases privacy and data-retention risk if the workstation, workspace, or repository is exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This script accesses a real Gmail account and prepares to write derived data to disk without any user-facing warning, consent prompt, or disclosure in the script itself. In a skill context, silent access to mailbox data and silent local persistence undermines informed consent and can surprise users about how their communications are being processed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script hardcodes a real-looking Gmail account default and a default keyring password, which embeds credential-related material directly in the helper. Even if intended for convenience, defaulting authentication secrets in code makes unauthorized mailbox access far easier when the script is reused, leaked, or executed in an unintended environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script retrieves inbox contents and stores the raw Gmail message search results in a predictable local cache file. Inbox metadata and message content are sensitive, and persisting them without clear user disclosure or protections increases the risk of unintended exposure through local compromise, backups, logs, or later processing by other tools.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The Node.js step derives subject, sender, snippets, and dates from inbox messages and writes them to another local JSON cache. Even summarized email data can contain confidential business or personal information, so creating an additional plaintext artifact broadens the exposure surface beyond the original mailbox.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/apply-labels.sh:23
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/build-voice-reference.sh:33