T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:19- Finding
Untrusted Email Content Is Processed Without Prompt-Injection Isolation
- Content
View full analysis
- Remediation
View remediation
Security audit
Gmail Inbox Zero Traige
Security checks for vulnerabilities and agentic risk
Overview
This Gmail triage skill is mostly aligned with its stated purpose, but it asks for broad mailbox access and includes unsafe credential-handling and under-scoped email-processing instructions.
Review this carefully before installing. Use a dedicated Gmail account or least-privilege OAuth grant where possible, do not put GOG_KEYRING_PASSWORD in shell history or shell profiles, remove any HOME=/root guidance, and require explicit review before opening unsubscribe links, creating filters, or executing batch archive actions. Also verify the actual .skill package includes the referenced scripts and pin or independently verify the gog CLI dependency before granting it Gmail access.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SETUP.md:92- Finding
Plaintext Persistence of the Gmail Keyring Password and Unsafe HOME Override
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SETUP.md:11- Finding
Security-Critical Gmail CLI Is Installed from an Unpinned Third-Party Tap
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (26)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The installation instructions explicitly tell the user to export
GOG_KEYRING_PASSWORD="your-password"in the shell environment. Placing a secret in an environment variable via command line/setup docs can expose it through shell history, process inspection, logs, or inherited environments, increasing the risk of credential disclosure. In the context of a Gmail-management skill with mailbox-wide read/write capabilities, compromise of this secret could facilitate access to stored OAuth material or the local keyring protecting email access.- Content
-
Authenticate Gmail:
bash gog auth add your@gmail.com --services gmail export GOG_KEYRING_PASSWORD="your-password" -
Install skill:
-
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Add your Gmail account with OAuth
gog auth add your@gmail.com --services gmail
Set keyring password (required for non-interactive use)
export GOG_KEYRING_PASSWORD="your-keyring-password"
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Add your Gmail account with OAuth
gog auth add your@gmail.com --services gmail
Set keyring password (required for non-interactive use)
export GOG_KEYRING_PASSWORD="your-keyring-password"
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The documentation explicitly tells users to export a keyring password as a shell environment variable, which is sensitive credential material. In this skill's context, that secret protects access to an authenticated Gmail account, so disclosure can enable unauthorized mailbox access or automation through the gog CLI.
- Content
gog auth add your@gmail.com --services gmail
Set keyring password (required for non-interactive use)
export GOG_KEYRING_PASSWORD="your-keyring-password"
text **Note:** The keyring password is what you set when first adding the account. If you don't remember it, you may need to re-add the account.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The documentation explicitly tells users to export a keyring password as a shell environment variable, which is sensitive credential material. In this skill's context, that secret protects access to an authenticated Gmail account, so disclosure can enable unauthorized mailbox access or automation through the gog CLI.
- Content
gog auth add your@gmail.com --services gmail
Set keyring password (required for non-interactive use)
export GOG_KEYRING_PASSWORD="your-keyring-password"
text **Note:** The keyring password is what you set when first adding the account. If you don't remember it, you may need to re-add the account.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The troubleshooting step again instructs users to export the Gmail keyring password into the environment. Repeating this pattern normalizes insecure secret handling and increases the likelihood that users expose credentials in terminal history, logs, or multi-user systems.
- Content
"No TTY for keyring password"
bash export GOG_KEYRING_PASSWORD="your-password""Permission denied"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The advanced setup recommends adding the keyring password to a persistent shell profile and even suggests setting HOME to /root, which can further blur privilege boundaries and encourage unsafe execution contexts. Persistently storing a Gmail-protecting secret in startup files creates a durable credential exposure risk and can compromise mailbox access if the host or account is breached.
- Content
bash export HOME=/root export GOG_KEYRING_PASSWORD="your-password"Then restart your terminal or run
source ~/.bashrc.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The documentation instructs users to export a keyring password directly in an environment variable using a literal example. Secrets placed in shell environment variables can be exposed through shell history, process inspection, logs, crash reports, or inherited child processes, making credential compromise more likely.
- Content
bash brew install steipete/tap/gogcli gog auth add your@gmail.com --services gmail export GOG_KEYRING_PASSWORD="your-password"- Use it:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The troubleshooting section repeats guidance to set the keyring password in an environment variable, reinforcing an unsafe secret-handling pattern. Repetition in troubleshooting makes the insecure practice more likely to be copied verbatim, increasing the chance of credential leakage on shared or monitored systems.
- Content
"No TTY for keyring password"
bash export GOG_KEYRING_PASSWORD="your-password"Full troubleshooting: See SETUP.md
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill processes all inbox messages, generates summaries, and displays content through an AI and Telegram-driven workflow without prominently warning that sensitive email data may be exposed beyond Gmail. In this context, the combination of bulk ingestion, summarization, and external presentation materially increases privacy and confidentiality risk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
Telling users to export a keyring password as an environment variable encourages insecure secret handling, since environment variables can be exposed through shell history, process inspection, logs, or inherited subprocesses. In a skill that orchestrates multiple scripts and external tools, this materially raises the risk of credential leakage and unauthorized mailbox access.
- Content
Set environment variable for keyring password:
bash export GOG_KEYRING_PASSWORD="your-password"Telegram Button Layout
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction uses the trigger phrase "triage my emails," which is broad natural language that overlaps with everyday requests and does not define clear activation boundaries. The file also does not provide exclusion conditions or a constrained invocation context to reduce accidental matches.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The phrase "process my inbox" is a very general request that could be used in ordinary conversation and may overlap with other email-related skills. No explicit trigger list boundaries, exclusions, or narrow context are provided alongside this invocation guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The overview promotes processing all inbox messages, showing full email content, and executing batch actions like archive/filter/unsubscribe, but it does not prominently warn users about privacy exposure and irreversible or high-impact mailbox changes. In an email-management skill, this increases the risk of accidental disclosure of sensitive message content and unintended bulk modifications to the user's mailbox.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example invocation "Triage my emails" is a natural-language phrase that many users could say in general conversation, and the overview does not define stricter activation boundaries or exclusion conditions. Because this is a markdown file, ambiguous trigger wording without scope constraints falls under vague-trigger concerns.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation phrase "triage my emails" is fairly generic and could be triggered during normal conversation about email management, causing the skill to start an action-capable workflow unexpectedly. In the context of a Gmail triage skill that can process all inbox messages and queue archive, filter, or unsubscribe actions, unintended invocation increases the risk of unauthorized or accidental email operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README promotes processing "ALL Gmail inbox messages" and batch actions like archive, filter, and unsubscribe without a clear warning that the skill can review large volumes of email content and later execute destructive mailbox changes. Users may install or invoke the skill without appreciating the privacy implications and operational impact, especially since batch execution can magnify mistakes across many messages.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The setup guide instructs users to place a keyring password in an environment variable but does not clearly warn that environment variables may be exposed via shell history, process inspection, logs, crash reports, or inherited child processes. This increases the risk of credential disclosure for a secret that protects Gmail access in a non-interactive workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The suggested invocation phrases are very generic (for example, 'Process my inbox' and 'Help me achieve inbox zero') and could be triggered during ordinary conversation, causing the agent to begin mailbox triage unexpectedly. In the context of a skill that can archive messages and create persistent Gmail filters, accidental invocation can lead to unintended mailbox modifications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage description emphasizes speed and convenience but does not prominently warn that the skill will execute batch actions that modify mailbox state and may create persistent Gmail filters. Users may not appreciate that clicking through summaries can result in durable changes affecting current and future mail handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file advertises AI-generated summaries of email content without a clear privacy warning that email data may be processed by an AI service. Since inbox contents often include sensitive personal or business information, omission of this disclosure can expose users to privacy and compliance risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description emphasizes speed and batch execution but does not clearly warn users that the skill will perform bulk mailbox modifications such as archive, filter creation, and unsubscribe actions. Missing disclosure can cause users to authorize or invoke the skill without understanding that multiple persistent changes may be executed at once.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phrase "Just say: 'Triage my emails'" is broad enough that it could be invoked unintentionally in normal conversation or by another prompt/context that mentions similar wording. Because this skill performs mailbox-affecting batch actions, accidental invocation increases the chance of unintended email processing or modification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase "Process my inbox" is ambiguous and overly generic, making it easy to match unrelated user intent or be triggered by contextual text. In a skill that can archive, filter, and unsubscribe emails in bulk, ambiguous activation materially raises the risk of unintended mailbox changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description emphasizes convenience and speed but does not clearly warn that the skill archives messages, marks them read, and creates persistent Gmail filters. Users may authorize actions without understanding that they permanently change mailbox state and future email handling.
- Content
Static analysis
No suspicious patterns detected.