ClawHub
Back to skill

Security audit

Google Docs

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing Google Docs, but it asks users to install an unpinned third-party CLI and includes an unsafe token-in-command login option for a high-impact document account.

Review before installing. Prefer browser login over the direct token command, use the narrowest possible token and Drive scopes, confirm sharing or trash operations manually, and consider installing a pinned or verified Porteden release rather than @latest or an unverified tap.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–13
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable code:

yaml
metadata: {"openclaw":{"emoji":"📄","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}}
markdown
If `porteden` is not installed: `brew install porteden/tap/porteden` (or `go install github.com/porteden/cli/cmd/porteden@latest`).

Technical Analysis

The documented Go installation resolves github.com/porteden/cli/cmd/porteden@latest at installation time instead of selecting a reviewed, immutable version or commit. Consequently, the executable installed by a user or agent may differ from the version assessed when this Skill was published. The Homebrew command also installs from a third-party tap without specifying a reviewed version or documenting an integrity check.

This creates supply-chain exposure: compromise of the upstream repository, module release process, package-distribution account, or Homebrew tap could cause the installation instructions to retrieve and execute altered code. The CLI is particularly sensitive because it can consume PE_API_KEY, access credentials stored in the system keyring, and perform Google Drive operations.

Attack Path

  1. An attacker compromises an upstream release channel, repository, maintainer account, Go module version, or Homebrew tap used to distribute porteden.
  2. The attacker publishes a modified release that resolves as the latest available ...[truncated 927 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace @latest with a specific, reviewed semantic version or immutable commit.
  • Pin the Homebrew installation to a reviewed release where supported, or provide a versioned release artifact instead of relying implicitly on the current tap state.
  • Publish expected SHA-256 checksums or cryptographic signatures and require verification before installation.
  • Document the expected package publisher, repository, signing identity, and release-verification process.
  • Use automated dependency monitoring to review and deliberately update the pinned version.
  • Run the CLI with least-privilege Google scopes and a restricted token so that a compromised dependency has limited access.
  • Prefer reproducible builds and verify that distributed binaries correspond to reviewed source code.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:18
Finding

API Token Exposed Through Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Sensitive credential passed as a process argument
Risk Level: Medium

Vulnerable code:

markdown
- **Direct token:** `porteden auth login --token <key>` — stored in system keyring

Technical Analysis

The documented authentication method instructs users to place an API token directly in a command-line argument. Although the CLI subsequently stores the credential in the system keyring, the token can be exposed before secure storage occurs.

Depending on the operating system, shell, and monitoring configuration, command-line arguments may be recorded in shell history, terminal transcripts, process-monitoring output, endpoint telemetry, audit logs, automation logs, or support transcripts. On systems where process arguments are visible to other local users or monitoring processes, the token may also be observable while the command is running.

Attack Path

  1. A user replaces the placeholder with a real API token and executes the documented command.
  2. The shell, terminal, operating system, automation platform, or security tooling records or exposes the complete command line.
  3. A local user, process, administrator, telemetry operator, or unauthorized log reader obtains the recorded token.
  4. The attacker submits the token through the legitimate CLI or API.
  5. The attacker performs operations permitted by the token until it expires, is revoked, or is otherwise restricted.

Impact Assessment

A recovered token could grant access to the Porteden service and connected Google Drive resources within the token's configured permissions. If Drive access and broad scopes are enabled, this may include reading document content, creating or editing documents, changing sharing permissions, generating download links, renaming files, or moving files to trash. The exact scope is limited by accessInfo, token restrictions, enabl ...[truncated 69 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace command-line token entry with hidden interactive input that does not echo or retain the credential.
  • Alternatively, read the token from standard input or a permission-restricted credential file and avoid including it in process arguments.
  • Make browser-based authentication the default and explicitly warn users not to place tokens in shell commands, scripts, or chat transcripts.
  • If environment-variable authentication remains supported, document the risks of inherited environments, diagnostic dumps, and verbose logs.
  • Ensure authentication code never logs, echoes, or includes the token in error messages.
  • Provide documented token revocation and rotation procedures for suspected exposure.
  • Recommend narrowly scoped, short-lived tokens with Drive access enabled only when required.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: google-docs-cli
description: Google Docs Secure Management. Use when the user wants to create, read, or edit Google Docs content; or manage sharing, permissions, renames, and deletes.
version: 1.0.8
metadata: {"openclaw":{"emoji":"📄","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}}
---

# porteden docs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
name: google-docs-cli
description: Google Docs Secure Management. Use when the user wants to create, read, or edit Google Docs content; or manage sharing, permissions, renames, and deletes.
version: 1.0.8
metadata: {"openclaw":{"emoji":"📄","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}}
---

# porteden docs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
name: google-docs-cli
description: Google Docs Secure Management. Use when the user wants to create, read, or edit Google Docs content; or manage sharing, permissions, renames, and deletes.
version: 1.0.8
metadata: {"openclaw":{"emoji":"📄","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}}
---

# porteden docs

Static analysis

No suspicious patterns detected.