ClawHub
Back to skill

Security audit

Gog

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Google Workspace CLI helper, but users should treat its OAuth access and third-party CLI install with care.

Install only if you trust the gog CLI source and are comfortable granting Google Workspace OAuth access. Prefer limiting authorization to the Google services you need, verify the Homebrew tap or upstream project before installing, and confirm any write actions such as sending mail, updating sheets, clearing ranges, or creating calendar events.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding
Unpinned Third-Party Homebrew Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned dependency from a third-party Homebrew tap **Risk Level**: Medium **Complete Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}} ``` ### Technical Analysis The installation metadata directs users to install `gogcli` from the third-party Homebrew tap `steipete/tap` without specifying a version, immutable revision, or expected checksum. Consequently, the component installed in the future may differ from the one available when this skill was audited. This creates a supply-chain trust boundary outside the reviewed project. If the tap, its maintainer account, the upstream release process, or a referenced binary artifact is compromised, Homebrew could install attacker-controlled content. No evidence in the audited files establishes that the current dependency is malicious; the confirmed issue is the lack of dependency pinning and integrity verification. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, upstream release infrastructure, or maintainer credentials. 2. The attacker modifies the formula or replaces an artifact referenced by it with a malicious version. 3. A user follows the skill installation metadata and installs `steipete/tap/gogcli`. 4. Homebrew processes the altered formula or installs the substituted executable under the user's privileges. 5. When the user configures or invokes `gog`, the malicious component can access local data available to that process, including OAuth-related material, and can misuse Google Workspace access granted to the CLI. ### Impact Assessment Successful exploitation could execute code with the privileges of the user running Homebrew. Because the documented CLI is authorized for Gmail, Calendar, Drive, Contacts, She ...[truncated 359 chars]
Remediation
## Remediation Suggestions - Pin the dependency to a reviewed, immutable release rather than relying on the tap's current formula state. - Verify downloaded artifacts using a cryptographic checksum or signature tied to the approved release. - Document the authoritative source repository and expected publisher identity so users can validate provenance. - Prefer a trusted package source with reproducible release artifacts and verifiable build provenance. - Review dependency updates before changing the approved version or checksum. - Request only the Google OAuth services and scopes required for the user's intended tasks rather than enabling all documented services by default. - Protect locally stored OAuth credentials with restrictive file permissions and revoke them immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.