Google Home Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:27 AM UTC
• Version: 1.0.3

Overview

This skill appears purpose-built for Google Home control, but it gives an agent persistent access to local Google OAuth credentials and real device-control authority with limited guardrails.

Review before installing. Use this only in a trusted local environment, with a dedicated Google project/account if possible, and only after you are comfortable letting the agent send real commands to linked devices. Prefer isolating the OAuth credential file, pinning dependencies, and requiring explicit confirmation before device changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35
• Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install google-assistant-sdk[samples] google-auth-oauthlib[tool] tenacity ``` ### Technical Analysis The documented setup command installs third-party packages without version constraints, cryptographic hashes, or a lock file. Consequently, the packages installed depend on whichever releases the package index serves at installation time. This does not establish that the named packages are currently malicious. However, it prevents users from reproducing a reviewed dependency set and exposes installation to compromised releases, compromised package-maintainer accounts, dependency substitution, and unexpected security or compatibility regressions. Python packages may execute code during installation and are subsequently imported by `scripts/control.py`. Such code runs with the privileges of the user operating the Skill and may be able to read the Google OAuth credential file used by the Skill. ### Attack Path 1. An attacker compromises a relevant package, one of its transitive dependencies, or its package-index publication process. 2. The attacker publishes a malicious release under a version permitted by the unpinned installation command. 3. A user follows the setup instructions and runs the documented `pip install` command. 4. The package manager resolves and installs the malicious or compromised release. 5. Malicious package code executes during installation or when imported at runtime. 6. The code acts with the user's privileges and may access local files, including Google OAuth credentials. ### Impact Assessment Successful exploitation could result in arbitrary code execution under the account installing or running the Skill. The resulting access may include theft of the Google OAuth credential file, unauthorized Assistant API requests, access to other user-re ...[truncated 190 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define reviewed, exact dependency versions in a requirements or lock file. 2. Generate and verify cryptographic hashes for all direct and transitive dependencies. 3. Install with hash enforcement, such as: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use an explicitly trusted package index and avoid unreviewed extra indexes. 5. Perform dependency vulnerability and provenance scanning before updating pinned versions. 6. Run the Skill in a dedicated virtual environment under a minimally privileged account. 7. Review dependency updates before regenerating the lock file rather than accepting releases automatically. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/control.py:33
• Finding: OAuth Refresh Destination Is Accepted from an Unvalidated Credential File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/control.py:33-46` **Vulnerability Type**: Unvalidated OAuth token endpoint **Risk Level**: Low ### Vulnerable Code ```python with open(creds_path, 'r') as f: creds_data = json.load(f) credentials = google.oauth2.credentials.Credentials( token=None, refresh_token=creds_data['refresh_token'], token_uri=creds_data['token_uri'], client_id=creds_data['client_id'], client_secret=creds_data['client_secret'], scopes=creds_data['scopes'] ) request = google.auth.transport.requests.Request() credentials.refresh(request) ``` ### Technical Analysis The OAuth token endpoint is read directly from the selected JSON credential file and passed to the Google authentication library without validating its scheme or hostname. Calling `credentials.refresh(request)` then performs a refresh request against that configured endpoint. The standard credential file generated by Google's OAuth utility is expected to contain a legitimate Google endpoint. Therefore, normal use does not constitute credential exfiltration, and reading the documented credential path is necessary for the Skill's authenticated functionality. The vulnerability arises if an attacker can supply or modify the credential file, including a file selected through the `GOG_HOME_CREDS` environment variable. A malicious `token_uri` may cause OAuth refresh material—including the refresh token, client identifier, and client secret—to be submitted to an attacker-controlled endpoint. HTTPS validation alone would not be sufficient because an attacker can obtain a valid certificate for a domain they control; the destination must also be allowlisted. ### Attack Path 1. An attacker gains the ability to modify the default credential file or influence the `GOG_HOME_CREDS` environment variable used when the Skill starts. 2. The attacker supplies an otherwise valid-looking JSON credential file containing the victim's OAuth fields and an ...[truncated 1142 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject token endpoints that are not HTTPS. 2. Parse the URI and allowlist the exact expected Google OAuth token hostname and path; do not rely on substring or suffix checks. 3. Prefer a trusted, application-defined Google token endpoint instead of accepting `token_uri` from the credential file when compatibility permits. 4. Validate the credential JSON schema and reject missing, unexpected, or incorrectly typed fields. 5. Resolve the credential path canonically and ensure the selected file is a regular file rather than an unsafe symbolic link. 6. Require restrictive credential-file permissions, such as owner read/write access only where supported. 7. Protect the process environment so untrusted callers cannot set `GOG_HOME_CREDS`. 8. Avoid logging refresh tokens, access tokens, client secrets, or complete credential documents in future error handling. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

1.  Go to **APIs & Services > Credentials**.
2.  Configure your **OAuth Consent Screen** (set User Type to "External" and add yourself as a test user).
3.  Create an **OAuth 2.0 Client ID** with the type **Desktop app**.
4.  Download the JSON file and rename it to `client_secret.json`.

### 3. Prepare the Python Environment
This skill requires a Python virtual environment with specific dependencies:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

1.  Go to **APIs & Services > Credentials**.
2.  Configure your **OAuth Consent Screen** (set User Type to "External" and add yourself as a test user).
3.  Create an **OAuth 2.0 Client ID** with the type **Desktop app**.
4.  Download the JSON file and rename it to `client_secret.json`.

### 3. Prepare the Python Environment
This skill requires a Python virtual environment with specific dependencies:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

google-oauthlib-tool --client-secrets /path/to/your/client_secret.json --scope https://www.googleapis.com/auth/assistant-sdk-prototype --save
```
*   This will open a browser window. Log in and grant permissions.
*   It will save a `credentials.json` file to `~/.config/google-oauthlib-tool/credentials.json`.

### 5. Final Configuration
Ensure the `google_home_env` is accessible to Clawdbot. When Clawdbot runs the skill, it will look for your credentials in the standard `~/.config` path automatically.

• Confidence: 89% confidence
• Finding: The skill states that runtime will automatically look for reusable OAuth credentials in a standard ~/.config location, implying persistent access to bearer credentials that can control the user's Google-linked devices. In agent context, automatic discovery and use of cached credentials materially increases the risk of unauthorized actions if the skill is invoked unexpectedly or if the environment is multi-tenant.

Credential Access

High

• Category: Privilege Escalation

Content

# Check for credentials in standard locations
    # 1. Environment variable GOG_HOME_CREDS
    # 2. Local config folder ~/.config/google-oauthlib-tool/credentials.json
    creds_path = os.environ.get('GOG_HOME_CREDS')
    if not creds_path:
        creds_path = os.path.expanduser('~/.config/google-oauthlib-tool/credentials.json')

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Check for credentials in standard locations
    # 1. Environment variable GOG_HOME_CREDS
    # 2. Local config folder ~/.config/google-oauthlib-tool/credentials.json
    creds_path = os.environ.get('GOG_HOME_CREDS')
    if not creds_path:
        creds_path = os.path.expanduser('~/.config/google-oauthlib-tool/credentials.json')

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Check for credentials in standard locations
    # 1. Environment variable GOG_HOME_CREDS
    # 2. Local config folder ~/.config/google-oauthlib-tool/credentials.json
    creds_path = os.environ.get('GOG_HOME_CREDS')
    if not creds_path:
        creds_path = os.path.expanduser('~/.config/google-oauthlib-tool/credentials.json')

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes capabilities that imply network access, filesystem reads, and use of locally stored OAuth credentials, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization ambiguity where an agent may invoke a powerful skill without clear guardrails, increasing the chance of overbroad access to local secrets and external services.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description is broad enough that the skill may be selected for generic home-automation phrasing without sufficiently signaling that it performs real-world actions on linked devices. In an agent ecosystem, overly broad activation can cause unintended invocation and trigger device operations the user did not mean to authorize through this specific integration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill introduces direct control of lights, TVs, and appliances but does not prominently warn that commands will execute on the user's real Google-linked devices. Lack of an explicit safety warning reduces informed consent and makes accidental or socially engineered real-world actions more likely.

Session Persistence

Medium

• Category: Rogue Agent

Content

To get this skill working, you'll need to link it to your own Google account. Follow these steps:

### 1. Create a Google Cloud Project
1.  Go to the [Google Cloud Console](https://console.developers.google.com/).
2.  Create a new project (e.g., "My Smart Home").
3.  Enable the **Google Assistant API**.

• Confidence: 76% confidence
• Finding: The skill depends on linking a persistent Google account session and retaining OAuth credentials for future use, which creates ongoing authority to issue smart-home commands. Persistent sessions are not inherently malicious, but in this context they increase blast radius because later invocations can act on real devices without fresh user authentication.

Static analysis

No suspicious patterns detected.