Nylas Email, Calendar & Contacts

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:40 PM UTC
• Version: 1.0.1

Overview

The skill’s email, calendar, and contacts purpose is coherent, but it combines broad account access, send/delete authority, an API key, and an unpinned external npm plugin in a way users should review carefully before installing.

Review the Nylas plugin and install source before use, prefer a pinned reviewed version if available, use the narrowest API key/grant possible, set NYLAS_GRANT_ID when you do not want all connected accounts auto-discovered, avoid pasting real secrets directly into shell commands, and require explicit review before sending emails or changing/deleting calendar events.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-23 and 35-37
Vulnerability Type: Unpinned npm dependency and mutable supply-chain source
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: npm
    package: "@nylas/openclaw-nylas-plugin"
dependencies:
  - name: "@nylas/openclaw-nylas-plugin"
    kind: npm

bash

openclaw plugins install @nylas/openclaw-nylas-plugin

Technical Analysis

The Skill directs users to install @nylas/openclaw-nylas-plugin without specifying a version or integrity hash. The package reference therefore resolves to a mutable npm release selected at installation time. Its executable contents are not included in the audited repository and can change independently of the reviewed SKILL.md.

Although the package name and linked resources appear official, the repository alone cannot establish the package's provenance or safety. A compromised publisher account, malicious future release, registry compromise, or compromised transitive dependency could introduce arbitrary executable behavior after this Skill has been reviewed.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a transitive dependency.
2. The attacker publishes a malicious version under the same mutable package name.
3. A user follows the documented openclaw plugins install command.
4. The package manager resolves and installs the malicious release because no trusted version or integrity value is specified.
5. The plugin executes with OpenClaw's local privileges and can attempt to access configuration, credentials, email, calendar, contacts, and other resources available to the process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the OpenClaw process. Depending on the runtime environment and credential scope, an attacker could obtain the configured Nylas API k ...[truncated 322 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to a specifically reviewed version, for example @nylas/openclaw-nylas-plugin@x.y.z.
• Use a lockfile or equivalent mechanism to pin all transitive dependencies.
• Verify registry provenance, publisher identity, release signatures, and package integrity hashes before installation.
• Prefer reproducible installation workflows that reject packages whose integrity does not match an approved checksum.
• Monitor the dependency and its transitive dependency tree for ownership changes, security advisories, and unexpected release behavior.
• Run the plugin with minimal filesystem, network, and process privileges.
• Use a narrowly scoped Nylas credential and explicit grant selection so a compromised plugin cannot access unrelated connected accounts.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:39

Finding

API Key Exposure Through Command-Line Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-43
Vulnerability Type: Sensitive credential exposure through shell history and process arguments
Risk Level: Low

Vulnerable Code

bash

openclaw config set nylas.apiKey "YOUR_NYLAS_API_KEY"

Technical Analysis

The setup documentation encourages users to replace the placeholder with a real Nylas API key directly in a shell command. Depending on the shell and operating system, this can record the credential in command history. Command-line arguments may also be visible temporarily through process-inspection facilities, debugging tools, terminal logging, or support-data collection.

The repository does not contain a real hardcoded credential and does not explicitly instruct users to transmit the key externally. The exposure occurs if a user follows the example by placing the actual secret directly in the command.

Attack Path

1. A user replaces YOUR_NYLAS_API_KEY with a valid credential and executes the documented command.
2. The shell records the complete command in its history, or a local monitoring process observes the command-line arguments.
3. An attacker with access to the user's account, shell-history files, terminal logs, process telemetry, backups, or diagnostic bundles retrieves the key.
4. The attacker submits requests to Nylas using the stolen credential.
5. The attacker accesses the grants and data authorized for that credential.

Impact Assessment

The attainable privileges depend on the Nylas API key's scope and connected grants. Exposure could allow access to connected email, calendar, and contact information. It could also enable actions advertised by the plugin, including reading or sending email and creating, updating, or deleting calendar events.

Auto-discovery of all accounts connected to the key may broaden the affected scope. Exploitation requires access to local history, process information, logs, backups ...[truncated 53 chars]

Remediation

View remediation

Remediation Suggestions

• Replace direct command-line secret entry with a masked interactive prompt that reads the key without echoing it.
• Support secure input through standard input or an operating-system credential manager.
• If environment-based configuration is supported, document a workflow that avoids writing the secret into shell history or expanding it into command arguments.
• Warn users not to paste credentials into commands recorded by shell history, terminal-session recording, or automation logs.
• Store the resulting credential in a protected secret store with restrictive filesystem permissions rather than plaintext configuration.
• Recommend narrowly scoped credentials, explicit grant IDs, regular rotation, revocation procedures, and monitoring for unauthorized use.
• Advise users who already entered a real key on the command line to remove exposed history entries and rotate the key.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill exposes powerful email, calendar, and contact capabilities, including reading full message contents, searching contacts, sending email, and creating/updating/deleting calendar events, but it does not warn users about the sensitivity of the data or the fact that it can perform external side effects. That omission increases the risk that users invoke the skill without understanding it may access private communications or modify/send data on their behalf across potentially multiple connected accounts.

Content

No source excerpt is available for this finding.