Security audit

gmail-wiki-ingest

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Gmail-to-wiki triage skill with bounded email reads, server-side controls, and clear user-facing behavior.

Install only if you want HiJavis to read Gmail metadata daily, sometimes read up to 12 full threads per run, and write selected correspondence into your wiki after server-side checks. Confirm the Gmail ingest switch and Google read-only permission match your expectations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 465)May include surrounding context.
md
node scripts/gmail-wiki-ingest.js fetch ──► metadata + knowledge model

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: '邮件入库' is somewhat broad and could be interpreted in multiple operational contexts, creating some chance of accidental activation. The risk is lower than the other phrases because it is more specialized, but it still lacks clear contextual constraints for a sensitive email-reading workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: '邮件入库' is somewhat broad and could be interpreted in multiple operational contexts, creating some chance of accidental activation. The risk is lower than the other phrases because it is more specialized, but it still lacks clear contextual constraints for a sensitive email-reading workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes broad natural-language phrases like "ingest my email" and "gmail ingest," which could plausibly appear in ordinary conversation or be echoed by other content, increasing the chance of unintended invocation. Because this skill performs email triage and can submit verdicts back to a server, accidental activation could cause undesired processing of a user's mailbox even if final enforcement remains server-side.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.
md
|---|---| | **LOW** | no card, no page. An auto-discard row on the ledger, `source='auto'`. | | **MIDDLE** | a pending `SkillData` row — the review card the user answers with Confirm / Discard. This is the day-one behavior and still the common case. | | **HIGH** | auto-confirmed and distilled into the wiki on the spot, with an undo offered on the card for a bounded window. | **The score alone never reaches HIGH.** The measured bands overlap — true-keep mail scores as low as 0.70, unwanted mail as high as 0.80 — so no cut point

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/banding-and-trust.md (reported line 25)May include surrounding context.
md
|---|---| | **LOW** | no card, no page. An auto-discard row on the ledger, `source='auto'`. | | **MIDDLE** | a pending `SkillData` row — the review card the user answers with Confirm / Discard. This is the day-one behavior and still the common case. | | **HIGH** | auto-confirmed and distilled into the wiki on the spot, with an undo offered on the card for a bounded window. | **The score alone never reaches HIGH.** The measured bands overlap — true-keep mail scores as low as 0.70, unwanted mail as high as 0.80 — so no cut point

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/banding-and-trust.md (reported line 56)May include surrounding context.
md
|---|---| | **LOW** | no card, no page. An auto-discard row on the ledger, `source='auto'`. | | **MIDDLE** | a pending `SkillData` row — the review card the user answers with Confirm / Discard. This is the day-one behavior and still the common case. | | **HIGH** | auto-confirmed and distilled into the wiki on the spot, with an undo offered on the card for a bounded window. | **The score alone never reaches HIGH.** The measured bands overlap — true-keep mail scores as low as 0.70, unwanted mail as high as 0.80 — so no cut point

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/banding-and-trust.md (reported line 91)May include surrounding context.
md
|---|---| | **LOW** | no card, no page. An auto-discard row on the ledger, `source='auto'`. | | **MIDDLE** | a pending `SkillData` row — the review card the user answers with Confirm / Discard. This is the day-one behavior and still the common case. | | **HIGH** | auto-confirmed and distilled into the wiki on the spot, with an undo offered on the card for a bounded window. | **The score alone never reaches HIGH.** The measured bands overlap — true-keep mail scores as low as 0.70, unwanted mail as high as 0.80 — so no cut point

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest defines the trigger prompt as "ingest my email," which is short and underspecified for activation purposes. It does not provide scope constraints, alternate allowed phrases, or exclusion examples, so it could match common conversational requests and cause unintended invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: '邮件入库' is somewhat broad and could be interpreted in multiple operational contexts, creating some chance of accidental activation. The risk is lower than the other phrases because it is more specialized, but it still lacks clear contextual constraints for a sensitive email-reading workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Lines L032-L036 state that 'The daily trigger is the whole trigger story,' which contradicts the rest of the file describing explicit manual triggers such as 'ingest my email' and the dedicated 'On-demand runs always reply' section. This is not merely incomplete wording; it actively conflicts with the skill's own documented activation paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The description hard-codes Chinese trigger phrases ('整理邮件', '邮件入库') alongside English ones, but does not explain whether multilingual activation is optional, user-configurable, or limited to a justified locale-specific deployment. This can violate language or locale policy when language behavior is imposed without explicit opt-in or documented rationale.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/cli.test.js:315