Security audit

Gog Html Email

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but it tells agents to render and send Gmail HTML emails using unsafe shell substitutions without clear confirmation or escaping controls.

Review before installing if you plan to send real email. Only use it with explicit user-approved recipients and content, preview the final HTML before sending, avoid untrusted template values, and prefer a renderer that escapes HTML and passes arguments safely instead of interpolating values into sed commands.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:20
Finding: Shell Command Injection Through Unsafe Dynamic sed Substitution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: templates/button.html:1
Finding: Unescaped HTML and URL Placeholder Injection in Email Templates
Content: View full analysis
Hi [NAME],
[MESSAGE]
[BUTTON_TEXT]
Best regards,
[SIGNATURE]
``` Equivalent raw placeholder insertion occurs across the template collection. URL-bearing examples include `templates/invoice.html` and `templates/welcome.html`, while text placeholders are used by all HTML templates. ### Technical Analysis Template values are inserted through literal text replacement without context-aware encoding. Text placeholders such as `[NAME]`, `[MESSAGE]`, `[BUTTON_TEXT]`, and `[SIGNATURE]` appear directly inside HTML element content. `[BUTTON_URL]` appears directly inside a quoted `href` attribute. An attacker-controlled text value can close an existing element and inject additional HTML. An attacker-controlled URL can close the attribute value and introduce additional attributes or markup. The templates also lack an explicit URL scheme allowlist, permitting deceptive or potentially unsafe URI schemes depending on the recipient’s email client. Although many email clients remove scripts, arbitrary HTML injection can still introduce: - Deceptive buttons and phishing links. ...[truncated 1912 chars]
Remediation: View remediation
`, `"`, and `'`. - Attribute-escape values placed inside HTML attributes. - Do not treat ordinary message text as trusted HTML. 2. Validate URL placeholders before rendering: - Parse URLs with a well-tested URL parser. - Permit only explicitly approved schemes, preferably `https`. - Reject control characters, protocol-relative URLs, encoded scheme bypasses, and malformed URLs. - Optionally restrict destinations to approved domains for payment and onboarding templates. 3. Separate trusted rich HTML from ordinary text: - Use distinct parameter types for plain text and administrator-approved HTML. - Sanitize any explicitly allowed HTML with an email-compatible allowlist sanitizer. 4. Render templates with a maintained templating engine that enables automatic escaping rather than raw `sed` substitution. 5. Remove or reject remote image elements and other resource-loading markup unless explicitly authorized. 6. Add security tests covering element termination, quote injection, event attributes, remote images, deceptive links, and unsafe URI schemes. 7. Preview and validate the final rendered HTML before sending, and fail closed if unresolved placeholders or disallowed markup remain. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to send emails through gog gmail send, which causes external transmission of potentially user-provided content. The dangerous part is not code execution but the lack of an explicit warning, confirmation step, or boundary around sending data off-system, which can lead to unintended disclosure, spam, or social-engineering abuse if an agent follows the workflow automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This HTML template contains fixed natural-language content such as "Eid Mubarak," "Taqabbal Allahu minna wa minkum," and "May Allah bless you," which imposes a specific religious/locale framing in the generated output. Under the policy rule for natural-language violations, forcing a specific language or cultural/religious expression without opt-in can be problematic when no user choice is indicated.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.