ClawHub
Back to skill

Security audit

gsuite-sdk

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Google Workspace access is clearly disclosed, fits its purpose, and includes confirmation requirements for sensitive actions.

Grant only the Google scopes you need, protect the credential and token files, and pin reviewed SDK and MCP versions. Keep confirmation controls enabled for sensitive changes and protect any REST deployment. This review covers the bundled instructions, not a full audit of external dependencies.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
| Variable | Default | Meaning |
|---|---|---|
| `GSUITE_CREDENTIALS_FILE` | `credentials.json` | OAuth client file from Google Cloud ([how to get it](https://pabloalaniz.github.io/google-suite/GETTING_CREDENTIALS/)) |
| `GSUITE_TOKEN_DB_PATH` | `tokens.db` | Where the login token is stored (SQLite) |
| `GSUITE_DEFAULT_TIMEZONE` | `UTC` | Time zone for "today" and for naive datetimes |

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
[REST API and deployment](references/rest-api.md) ·

MCP server referenced without pinned version: 'uvx gsuite-mcp'.

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The MCP registration launches uvx gsuite-mcp without specifying a version, allowing package resolution to select an unreviewed release. If that release is compromised, its code would run locally with access to the configured Google token database and potentially sensitive email, files, and account operations; the file does not establish that any compromise has occurred.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'uvx gsuite-mcp'.

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The alternative-client instructions repeat the same unpinned MCP launch command, so those clients can also resolve an unreviewed package release. A compromised server would receive access to the configured credentials and Google capabilities, making this the same supply-chain exposure as the registration command rather than a separate attack mechanism.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/mcp.md (reported line 17)May include surrounding context.

md
`GSUITE_TOKEN_DB_PATH` (and `GSUITE_CREDENTIALS_FILE`) set to **absolute**
paths: the server doesn't run from the directory where you logged in.

Tools (read-only ones are annotated so clients can run them without asking):

| Area | Tools |
|---|---|

Static analysis

No suspicious patterns detected.