ClawHub
Back to skill

Security audit

Clawback

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Gmail proxy, but it exposes high-impact mailbox actions like deletes and label changes without clear confirmation guidance beyond sending email.

Install only if you trust the Clawback CLI and service with Gmail access. Before using it, treat deletes, batch modifies, label changes, and draft actions as sensitive operations and require a clear preview plus explicit confirmation, even though the skill only states that requirement for sending email.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description frames the tool as a Gmail proxy for reading, searching, or sending email, but the documented command set also includes label modification, batch delete, drafts deletion, and mailbox/settings administration. This scope mismatch can cause an agent or user to underestimate the authority granted to the tool and invoke destructive or high-impact actions without appropriate safeguards or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents destructive and account-affecting operations such as batch delete, label modification, and drafts deletion without explicit warnings or mandatory confirmation guidance. In an agent setting, this increases the risk of accidental data loss or mailbox state changes, especially if the agent infers user intent too broadly.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
1. Tell the user in plain language: "Sent! It needs approval in Clawback before it goes through — I'll keep an eye on it."
2. Poll `clawback approvals get <approvalId> --json` in the background every ~30s.
3. When resolved, proactively tell the user: "Approved and delivered" or "The approval was rejected/expired — the email was not sent."
4. Never ask the user to run commands or check approval status themselves.

Handling other errors

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instructions say 'Never expose approval IDs' as internal plumbing, yet the approval-handling section tells the agent to run clawback approvals get <approvalId> --json, which necessarily depends on obtaining and handling that identifier. While this may be intended as internal-only use, the documentation creates tension between the prohibition and the prescribed workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.