ClawHub
Back to skill

Security audit

Email Gmail Outlook Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed read-only Gmail/Outlook email lookup helper, with some credential and callback handling notes users should treat carefully.

Install only if you trust the porteden CLI and are comfortable granting it Gmail/Outlook read access. Prefer browser/keyring login, avoid putting API keys in shell profiles, do not use untrusted callback URLs, and log out after use on shared machines.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill accepts an arbitrary callback_url even though its stated purpose is local read/search of Gmail and Outlook mail. Introducing arbitrary outbound callbacks creates an unnecessary exfiltration and SSRF-like surface, especially if mail content or metadata could be sent to attacker-controlled URLs after processing.

Credential Access

High
Category
Privilege Escalation
Content
### 4. keyring 不可用

- **现象**:`porteden auth login` 报 keyring access denied
- **处理**:检查系统钥匙串服务,或改用 `PE_API_KEY` 环境变量

### 5. 正文过大导致 token 超限
Confidence
84% confidence
Finding
keyring

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.