Gmail Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:31 PM UTC
• Version: 1.2.0

Overview

This Gmail automation skill is visibly Gmail-focused, but it combines destructive mailbox access with detached shell execution, broad OAuth tokens, sensitive WhatsApp delivery, and weak local handling that require careful review before use.

Review this skill before installing. Use it only if you are comfortable granting broad Gmail control, external WhatsApp delivery of task output, local token/job/log files, and detached deletion jobs. Avoid enabling full-scope permanent deletion unless absolutely necessary, and do not run destructive background tasks without verifying the exact command, target account, labels, dates, and WhatsApp recipient.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

other

Error

• Location: bins/gmail-background-task.sh:83

Finding

Automatic Transmission of Sensitive Gmail Data to WhatsApp

Content

View full analysis

&1 || echo "No unread messages found" ``` ```bash # bins/gmail-background-task.sh:83-85 send_notify() { echo "$(date): notify: ${1:0:80}..." >> "$MONITOR_LOG" openclaw message send --channel whatsapp --target "$NOTIFY_TARGET" --message "$1" >> "$MONITOR_LOG" 2>&1 || true } ``` ```bash # bins/gmail-background-task.sh:156-173 OUTPUT=$(tail -50 "$LOG_FILE") if [[ $EXIT_CODE -eq 0 ]]; then send_notify "✅ Gmail Skill: Task '"'"'$TASK_NAME'"'"' completed successfully Duration: $DURATION Account: $ACCOUNT ━━━━━━━━━━━━━━━━━━━━━━━━━━ $OUTPUT" else send_notify "❌ Gmail Skill: Task '"'"'$TASK_NAME'"'"' failed (exit $EXIT_CODE) Duration: $DURATION Account: $ACCOUNT ━━━━━━━━━━━━━━━━━━━━━━━━━━ $OUTPUT" fi ``` ### Technical Analysis The daily digest runs a Gmail search whose plain-text response can contain message IDs, dates, sender addresses, subjects, and labels. The background wrapper captures command output in a log, reads its final 50 lines, and sends those lines to the configured WhatsApp destination using `openclaw message send`. The Skill documentation mandates this wrapper for several operations and explicitly designs the daily digest for WhatsApp delivery. Although the behavior is disclosed, transmitting detailed mailbox output is not necessary for label enumeration, spam cleanup, message deletion, or other core Gmail operations. It therefore exceeds the minimum data disclosure required for those tasks. The destination is select ...[truncated 1250 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: bins/gmail-background-task.sh:18

Finding

Arbitrary Shell Command Injection Through Generated Shell Source and eval

Content

View full analysis

> "$LOG_FILE" 2>&1 & ``` The documented destructive workflow builds command strings containing user-selected values: ```bash bash skills/gmail-skill/bins/gmail-background-task.sh \ "Delete Label: " \ "bash skills/gmail-skill/bins/gmail-delete-labels.sh '' --delete-messages '$GMAIL_ACCOUNT'" ``` ### Technical Analysis The wrapper combines all command arguments into a single string, interpolates that string and other values into source code passed to `bash -c`, and subsequently executes the command using `eval`. Quoting the label in the documented template does not provide a security boundary. A label or task name containing a single quote and shell syntax can terminate the generated assignment or quoted argument and introduce a new command. Because the wrapper invokes another shell and then uses `eval`, input is interpreted as shell syntax multiple times. Potentially influenced values include: - Task names derived from operation descriptions. - Command strings containing user-selected label names and dates. - `GMAIL_ACCOUNT`. - `WHATSAPP_NOTIFY_TARGET`. - `WHATSAPP_UPDATE_INTERVAL`. The injected command runs in a detached process with the privileges and environment of the Agent user. ### Attack Path 1. An attacker creates or cause ...[truncated 1189 chars]

Remediation

View remediation

>"$LOG_FILE" 2>&1 & ``` 4. Pass values into a detached shell through positional parameters rather than source interpolation: ```bash nohup bash -c 'task_name=$1; shift; "$@"' bash "$TASK_NAME" "$@" ... ``` 5. Prefer implementing the monitor without a second generated shell program. 6. Validate `WHATSAPP_UPDATE_INTERVAL` as a bounded positive integer. 7. Treat account names, task names, labels, dates, and notification targets as untrusted data. 8. Add regression tests containing quotes, semicolons, command substitutions, newlines, and redirection operators. 9. Avoid constructing commands in `SKILL.md`; document argument-safe invocations instead. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: bins/gmail-auth-full-scope.sh:28

Finding

Full-Mailbox OAuth Refresh Token Stored Without Explicit Permission Hardening

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: bins/gmail-background-task.sh:36

Finding

Predictable and Unprotected Sensitive Log Files in /tmp

Content

View full analysis

"$LOG_FILE" echo "Started: $(date)" >> "$LOG_FILE" echo "" >> "$LOG_FILE" echo "Monitor started: poll=${POLL_INTERVAL}s, notify=${UPDATE_INTERVAL}s" > "$MONITOR_LOG" eval "$COMMAND" >> "$LOG_FILE" 2>&1 & ``` ```bash OUTPUT=$(tail -50 "$LOG_FILE") ``` ### Technical Analysis Log names are derived only from a timestamp with one-second resolution. They are therefore predictable and may collide when multiple jobs start during the same second. The files are created through ordinary shell redirection without `mktemp`, exclusive creation, symlink checks, or explicit restrictive permissions. Shell redirection follows symbolic links. An attacker with access to the shared temporary directory can predict a filename and pre-create it as a symbolic link. When the task starts, `>` may truncate the symlink target and subsequent writes may corrupt it, subject to operating-system protections and the Agent user's file permissions. The logs can contain the complete command, Gmail account identity, email metadata, labels, local paths, and API errors. Under a permissive umask, other local users may be able to read this information. ### Attack Path 1. A local attacker predicts `/tmp/gmail-bg-YYYYMMDD-HHMMSS.log`. 2. The attacker creates a file or symbolic link at that location before the task starts. 3. The wrapper opens the path using `>`, following the link or reusing the pre-created file. 4. The Agent writes comman ...[truncated 714 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: bins/gmail-background-task.sh:60

Finding

Destructive Gmail Operations Are Mandatorily Detached From Agent Lifecycle

Content

View full analysis

/dev/null 2>&1 & disown ``` The Skill instructions mandate this behavior: ```markdown For Capabilities 2, 3, 5, 6 — you MUST use `gmail-background-task.sh` as the wrapper. NEVER run the underlying scripts directly. NEVER use `timeout`. ALWAYS use the wrapper above. ``` ### Technical Analysis The wrapper launches tasks with `nohup`, backgrounds them, disconnects standard input, and calls `disown`. As a result, tasks survive termination of the Agent process and cannot be controlled through the originating execution lifecycle. This is not a startup service or cross-reboot persistence mechanism. However, it is operational persistence for the duration of the detached process. It is particularly risky because the mandated background operations include deleting labels, trashing messages, and permanently deleting old messages. The project provides status inspection but no corresponding cancellation command, process ownership verification, or rollback mechanism for permanent deletion. ### Attack Path 1. The user confirms a destructive label or old-message deletion operation. 2. The Agent is required to invoke the background wrapper. 3. The wrapper detaches the operation using `nohup` and `disown`. 4. The Agent session times out, is terminated, or the user changes their mind. 5. The deletion process continues independently. 6. For full-scope operations, messages may be permanently deleted before intervention is possible. ### Impact Assessment The user can lose effective control over an in-progress destructive operation ...[truncated 407 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: bins/gmail-move-to-label.sh:58

Finding

Inbox-Only Message Movement Restriction Is Not Enforced by the Script

Content

View full analysis

&2 return 1 fi echo -e "${BLUE}Moving ${#message_ids[@]} message(s) to label: ${label}${NC}" >&2 # Add the target label and remove INBOX label gog gmail batch modify "${message_ids[@]}" \ --add-labels "$label" \ --remove-labels "INBOX" \ --account "$ACCOUNT" 2>/dev/null echo -e "${GREEN}✓ Moved ${#message_ids[@]} message(s) to ${label}${NC}" >&2 } ``` ```bash --move) TARGET_LABEL="${3:-}" shift 3 || true MESSAGE_IDS=("$@") if [[ -z "$TARGET_LABEL" ]]; then echo "ERROR: No target label provided" >&2 exit 1 fi if [[ ${#MESSAGE_IDS[@]} -eq 0 ]]; then echo "ERROR: No message IDs provided" >&2 exit 1 fi move_messages_to_label "$TARGET_LABEL" "${MESSAGE_IDS[@]}" ``` The declared safeguard is: ```markdown ONLY move messages that are in the INBOX. MUST show messages to user and get confirmation before moving. ``` ### Technical Analysis The safety restriction exists only in Agent instructions. The mutation function accepts arbitrary Gmail message IDs and passes them directly to `gog gmail batch modify`. It does not retrieve each message immediately before modification, verify the presence of the `INBOX` label, or prove that the IDs came from the preceding `--list-inbox` operation. The script also does not bind a confirmed selection to a short-lived transaction or approval record. A caller can invoke `--move` directly with stale, fabricated, or externally obtained message ...[truncated 1098 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: bins/gmail-delete-labels.sh:38

Finding

Security-Critical Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

/dev/null; then echo "Error: gog CLI not found. Install via: npm install -g gogcli" >&2 exit 1 fi ``` ```bash # Check Python dependencies if ! python3 -c "from google.oauth2.credentials import Credentials; from googleapiclient.discovery import build" 2>/dev/null; then echo "Error: Missing Python packages. Install via:" >&2 echo " pip install google-auth google-api-python-client" >&2 exit 1 fi ``` Equivalent unpinned Python installation guidance also appears in `gmail-delete-old-messages.sh`. ### Technical Analysis The installation guidance references mutable package names without version constraints, lockfiles, hashes, signatures, or a reviewed package source. The npm command installs globally, increasing the impact of a compromised package or install-time script. These dependencies are security-critical: - `gogcli` handles Gmail operations and exports OAuth tokens. - `google-auth` handles refresh tokens. - `google-api-python-client` performs destructive Gmail API requests. A malicious or unexpectedly changed package version would execute in a context where Gmail credentials and sensitive mailbox data are available. The reviewed files do not automatically run the installation commands, but users are explicitly instructed to do so when dependencies are missing. ### Attack Path 1. A required dependency is absent. 2. The user follows the script's installation guidance. 3. The package manager resolves the latest package version from its configured registry. 4. A compromised package, compromised release, or malicious registry response is installed. 5. Package installation code or runtime code executes with the user's privileges. 6. The dependency access ...[truncated 414 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description does not make clear that it maintains a local job registry, checks process liveness, and mutates job status files independently of direct Gmail operations. Hidden persistence and autonomous status management expand the attack surface and can surprise users or policy engines that rely on the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description does not make clear that it maintains a local job registry, checks process liveness, and mutates job status files independently of direct Gmail operations. Hidden persistence and autonomous status management expand the attack surface and can surprise users or policy engines that rely on the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description does not make clear that it maintains a local job registry, checks process liveness, and mutates job status files independently of direct Gmail operations. Hidden persistence and autonomous status management expand the attack surface and can surprise users or policy engines that rely on the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description does not make clear that it maintains a local job registry, checks process liveness, and mutates job status files independently of direct Gmail operations. Hidden persistence and autonomous status management expand the attack surface and can surprise users or policy engines that rely on the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description does not make clear that it maintains a local job registry, checks process liveness, and mutates job status files independently of direct Gmail operations. Hidden persistence and autonomous status management expand the attack surface and can surprise users or policy engines that rely on the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description does not make clear that it maintains a local job registry, checks process liveness, and mutates job status files independently of direct Gmail operations. Hidden persistence and autonomous status management expand the attack surface and can surprise users or policy engines that rely on the declared scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill promises WhatsApp progress and result delivery without warning that email-derived data may be transmitted outside Gmail and the local agent environment. In a mail-management context, even counts, subjects, sender names, or cleanup results can reveal sensitive personal or business information to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The scheduled daily run automatically delivers digest results via WhatsApp without a clear consent or privacy warning. Automating repeated outbound transmission of mailbox-derived summaries materially increases the likelihood of ongoing data leakage, especially if the user forgets the integration is enabled.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-auth-full-scope.sh (reported line 19)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-auth-full-scope.sh (reported line 23)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-delete-labels.sh (reported line 204)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-delete-labels.sh (reported line 209)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-delete-labels.sh (reported line 211)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-delete-labels.sh (reported line 212)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-delete-labels.sh (reported line 232)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-delete-old-messages.sh (reported line 154)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bins/gmail-delete-old-messages.sh (reported line 158)May include surrounding context.

sh

fi

GOG_CREDS_DIR="${HOME}/Library/Application Support/gogcli"
if [[ ! -f "$GOG_CREDS_DIR/credentials.json" ]]; then
    GOG_CREDS_DIR="${HOME}/.config/gogcli"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script passes a local OAuth client credential file into Python, requests the full Gmail scope (https://mail.google.com/), and stores a refresh token for persistent access, including permanent deletion. In the context of an automation skill, granting and retaining broad mailbox access materially increases blast radius if the token file is stolen, reused by other code, or the skill is misused.

Content

Scanner excerpt · bins/gmail-auth-full-scope.sh (reported line 39)May include surrounding context.

sh

echo "A browser window will open. Sign in with $ACCOUNT and authorize."
echo ""

python3 - "$GOG_CREDS_DIR/credentials.json" "$TOKEN_FILE" "$ACCOUNT" << 'PYEOF'
import json, sys

creds_file = sys.argv[1]

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script builds a command string from user-supplied arguments and executes it with eval inside a detached background process. This enables arbitrary shell command execution, command injection, and persistence-like behavior, effectively turning the skill into a general-purpose remote command runner rather than a bounded Gmail automation tool.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

The script passes both an exported OAuth token file and the gog client credentials.json into inline Python, then uses them to refresh Gmail API credentials capable of trashing or permanently deleting messages. In this skill context, accessing local Gmail OAuth material materially increases risk because the script performs destructive mailbox operations, and compromise or misuse of those credentials could enable broad unauthorized email deletion.

Content

Scanner excerpt · bins/gmail-delete-old-messages.sh (reported line 177)May include surrounding context.

sh

SEARCH_QUERIES+="]"

# Run Python to search and delete
result=$(python3 - "$TOKEN_FILE" "$GOG_CREDS_DIR/credentials.json" "$SEARCH_QUERIES" "$CAN_DELETE" << 'PYEOF'
import json, sys
from datetime import datetime

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares no explicit tool scope even though it clearly instructs the agent to invoke shell commands that can modify mailbox state and create local files/logs. Missing permission boundaries increases the chance that a host agent will grant broader capabilities than the user expects, especially for destructive operations like cleanup, deletion, and background job management.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation trigger is broad enough to match many ordinary requests about email or folders, which can cause the skill to run in contexts the user did not specifically intend. Because this skill includes destructive and background behaviors, over-triggering increases the chance of unauthorized cleanup, deletion workflows, or external notifications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends progress and results via WhatsApp even though that outbound channel is not justified by the Gmail-focused purpose. This creates an unnecessary data egress path for email-derived metadata or content, increasing privacy and confidentiality risk if sensitive mailbox information is included in those updates.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description focuses on Gmail automation tasks like summarization, labels, spam purge, filing, deletion, and permanent delete. However, this section adds an authorization/setup capability that opens a browser for OAuth consent and stores a full-scope token locally, which is a broader operational behavior than the manifest describes as a user-facing skill action.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script adds a persistent background execution and WhatsApp notification subsystem that is outside the narrowly stated Gmail automation scope. That scope expansion matters because it creates an additional communication channel and execution mode that can move data and actions beyond the expected Gmail-only boundary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.