.Gog.Disabled.20260401 113230

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

The skill is coherent, but it relies on an unpinned third-party CLI and broad Google Workspace OAuth access with live write/delete examples that lack adequate guardrails.

Review the gog project and Homebrew tap before installing, authorize only the Google services you actually need, test write commands on non-production data first, and treat mail sending, calendar creation, and Sheets clear/update commands as actions that can affect real Workspace content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party Homebrew Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}} ``` ### Technical Analysis The Skill directs users to install `gogcli` from the third-party Homebrew tap `steipete/tap` without pinning an immutable version, formula revision, commit, checksum, or cryptographic signature. Consequently, the package installed in the future may differ from the artifact that was available when this Skill was reviewed. This creates a supply-chain trust boundary: control of the tap, formula, release assets, or associated distribution infrastructure can influence code executed during installation and subsequent CLI use. The risk is particularly relevant because the installed CLI is intended to receive OAuth authorization for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. The project contains no embedded executable scripts, and the reviewed files do not themselves demonstrate malicious behavior. The vulnerability is limited to the mutable and unverified dependency installation mechanism. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its maintainer account, the referenced release infrastructure, or another component in the package distribution chain. 2. The attacker modifies the formula or replaces a release artifact with a malicious version while retaining the expected package name. 3. A user installs or upgrades the dependency through the Skill's unpinned `steipete/tap/gogcli` formula. 4. Homebrew executes attacker-controlled installation logic or installs an attacker-controlled `gog` binary under the user's account. 5. When the user performs OAuth setup or invokes Workspace commands, the malicious ...[truncated 830 chars]
• Remediation: ## Remediation Suggestions 1. Pin installation to a reviewed, immutable release version and, where supported, an immutable formula commit. 2. Verify downloaded release artifacts using a published cryptographic checksum or signature before installation. 3. Prefer an authoritative package source controlled by the upstream project and document the source repository and release-verification procedure. 4. Avoid automatic upgrades to unreviewed releases; require explicit review before changing the pinned version. 5. Document the exact OAuth scopes requested and apply least privilege by authorizing only the Workspace services needed for each user workflow. 6. Store OAuth credentials using operating-system-protected credential storage, restrict file permissions, and provide token revocation and rotation instructions. 7. Consider reproducible builds or provenance attestations so users can verify that the distributed binary corresponds to reviewed source code.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises state-changing and potentially destructive operations such as Sheets update, append, and clear without explicit guardrails about overwriting or deleting data. In an agent context, this increases the chance of accidental destructive actions against real Google Workspace content, especially if commands are reused or parameterized automatically.

Static analysis

No suspicious patterns detected.