thayyilshihab

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:29 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Google Workspace CLI helper, but it installs an unpinned third-party executable and documents live Workspace write/delete actions without enough confirmation guidance.

Review this before installing. Use the narrowest OAuth services needed for the current task, verify the gogcli Homebrew tap and release provenance, and require explicit confirmation before any send, create, update, append, clear, copy, or other Workspace write operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5
• Finding: Unpinned executable installed from a third-party Homebrew tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}} ``` ### Technical Analysis The Skill directs the host to install `gogcli` from the custom Homebrew tap `steipete/tap` without pinning a version, commit, or cryptographic checksum. The effective executable can therefore change after this Skill has been reviewed. This is especially sensitive because the installed CLI is expected to receive OAuth-backed access to Gmail, Calendar, Drive, Contacts, Sheets, and Docs. If the tap, formula, upstream release process, or associated maintainer account were compromised, a modified executable could run with the local user's privileges and access the Google Workspace data authorized by the user. The repository does not itself demonstrate that the dependency is currently malicious. The vulnerability is the mutable and insufficiently verified supply-chain trust boundary. ### Attack Path 1. An attacker compromises the custom Homebrew tap, its maintainer account, the referenced upstream release, or another component of its distribution chain. 2. The attacker modifies the formula or distributed binary to include malicious behavior. 3. The Skill environment installs or upgrades `steipete/tap/gogcli` without verifying a project-pinned version and checksum. 4. The user completes the documented OAuth authorization process. 5. The modified executable runs under the user's account and can attempt to read OAuth material, access authorized Workspace services, inspect locally accessible files, or transmit collected data. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running Homebrew and the CLI. It could als ...[truncated 226 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the dependency to a reviewed release rather than installing an implicitly mutable latest version. - Verify the downloaded artifact using a project-controlled cryptographic checksum or signature. - Document the canonical source repository and trusted release-signing identity. - Prefer a trusted and independently reviewed package source over a custom tap where practical. - Apply least-privilege OAuth scopes and authorize only the Workspace services needed for the current task. - Keep OAuth credentials outside project files and protect them using operating-system credential storage. - Establish a controlled dependency-update process that reviews formula and upstream changes before upgrading. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24
• Finding: Destructive Workspace operations are not covered by the confirmation policy<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-36 **Vulnerability Type**: Missing confirmation control for consequential remote operations **Risk Level**: Medium ### Vulnerable Code ```markdown - Sheets update: `gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED` - Sheets append: `gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS` - Sheets clear: `gog sheets clear <sheetId> "Tab!A2:Z"` - Sheets metadata: `gog sheets metadata <sheetId> --json` - Docs export: `gog docs export <docId> --format txt --out /tmp/doc.txt` - Docs cat: `gog docs cat <docId>` Notes - Set `GOG_ACCOUNT=[e-mail]` to avoid repeating `--account`. - For scripting, prefer `--json` plus `--no-input`. - Sheets values can be passed via `--values-json` (recommended) or as inline rows. - Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog). - Confirm before sending mail or creating events. ``` ### Technical Analysis The Skill documents spreadsheet update, append, and clear operations, including an explicitly destructive `sheets clear` command. However, its confirmation requirement only covers sending email and creating calendar events. It does not require confirmation before modifying or clearing spreadsheet data. The recommendation to use `--no-input` for scripting can further reduce interactive safeguards. In an agentic environment, untrusted task text or incorrectly inferred parameters could cause the Agent to invoke a write operation against the wrong spreadsheet, tab, or range without presenting the proposed change to the user. This is a missing safety control rather than evidence of intentional malicious behavior. ### Attack Path 1. The Agent processes untrusted or ambiguous content that requests or induces a spreadsheet operation. 2. That content causes the Agent to select `gog sheets update`, `append`, or `clear`. 3. The Agent suppli ...[truncated 701 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit user confirmation before every external write, deletion, send, share, permission change, or resource-creation operation. - Before confirmation, display the account, resource identifier, tab, range, operation type, and exact proposed values. - Treat `sheets clear` as destructive and require an additional high-friction confirmation. - Do not use `--no-input` for consequential operations unless a separate approval mechanism has already authorized the exact action. - Validate spreadsheet identifiers and ranges against the user's request. - Use the narrowest possible OAuth scopes and read-only scopes for tasks that do not require modification. - Where supported, create backups or retrieve the existing values before destructive changes to facilitate recovery. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill includes modifying Google Workspace operations such as Sheets update, append, and clear without prominently warning about the risk of overwriting or deleting user data. In an agent context, these commands can be executed against live user resources, so omission of guardrails increases the chance of accidental destructive actions.

Static analysis

No suspicious patterns detected.