T08 · Insecure Dependencies
Warning
- Location
SKILL.md:35- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Google Home Control
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-built for Google Home control, but it gives an agent persistent access to local Google OAuth credentials and real device-control authority with limited guardrails.
Review before installing. Use this only in a trusted local environment, with a dedicated Google project/account if possible, and only after you are comfortable letting the agent send real commands to linked devices. Prefer isolating the OAuth credential file, pinning dependencies, and requiring explicit confirmation before device changes.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/control.py:33- Finding
OAuth Refresh Destination Is Accepted from an Unvalidated Credential File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. Go to **APIs & Services > Credentials**. 2. Configure your **OAuth Consent Screen** (set User Type to "External" and add yourself as a test user). 3. Create an **OAuth 2.0 Client ID** with the type **Desktop app**. 4. Download the JSON file and rename it to `client_secret.json`. ### 3. Prepare the Python Environment This skill requires a Python virtual environment with specific dependencies:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. Go to **APIs & Services > Credentials**. 2. Configure your **OAuth Consent Screen** (set User Type to "External" and add yourself as a test user). 3. Create an **OAuth 2.0 Client ID** with the type **Desktop app**. 4. Download the JSON file and rename it to `client_secret.json`. ### 3. Prepare the Python Environment This skill requires a Python virtual environment with specific dependencies:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill states that runtime will automatically look for reusable OAuth credentials in a standard ~/.config location, implying persistent access to bearer credentials that can control the user's Google-linked devices. In agent context, automatic discovery and use of cached credentials materially increases the risk of unauthorized actions if the skill is invoked unexpectedly or if the environment is multi-tenant.
- Content
google-oauthlib-tool --client-secrets /path/to/your/client_secret.json --scope https://www.googleapis.com/auth/assistant-sdk-prototype --save
text * This will open a browser window. Log in and grant permissions. * It will save a `credentials.json` file to `~/.config/google-oauthlib-tool/credentials.json`. ### 5. Final Configuration Ensure the `google_home_env` is accessible to Clawdbot. When Clawdbot runs the skill, it will look for your credentials in the standard `~/.config` path automatically.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Check for credentials in standard locations # 1. Environment variable GOG_HOME_CREDS # 2. Local config folder ~/.config/google-oauthlib-tool/credentials.json creds_path = os.environ.get('GOG_HOME_CREDS') if not creds_path: creds_path = os.path.expanduser('~/.config/google-oauthlib-tool/credentials.json')
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Check for credentials in standard locations # 1. Environment variable GOG_HOME_CREDS # 2. Local config folder ~/.config/google-oauthlib-tool/credentials.json creds_path = os.environ.get('GOG_HOME_CREDS') if not creds_path: creds_path = os.path.expanduser('~/.config/google-oauthlib-tool/credentials.json')
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Check for credentials in standard locations # 1. Environment variable GOG_HOME_CREDS # 2. Local config folder ~/.config/google-oauthlib-tool/credentials.json creds_path = os.environ.get('GOG_HOME_CREDS') if not creds_path: creds_path = os.path.expanduser('~/.config/google-oauthlib-tool/credentials.json')
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes capabilities that imply network access, filesystem reads, and use of locally stored OAuth credentials, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization ambiguity where an agent may invoke a powerful skill without clear guardrails, increasing the chance of overbroad access to local secrets and external services.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description is broad enough that the skill may be selected for generic home-automation phrasing without sufficiently signaling that it performs real-world actions on linked devices. In an agent ecosystem, overly broad activation can cause unintended invocation and trigger device operations the user did not mean to authorize through this specific integration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill introduces direct control of lights, TVs, and appliances but does not prominently warn that commands will execute on the user's real Google-linked devices. Lack of an explicit safety warning reduces informed consent and makes accidental or socially engineered real-world actions more likely.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The skill depends on linking a persistent Google account session and retaining OAuth credentials for future use, which creates ongoing authority to issue smart-home commands. Persistent sessions are not inherently malicious, but in this context they increase blast radius because later invocations can act on real devices without fresh user authentication.
- Content
md To get this skill working, you'll need to link it to your own Google account. Follow these steps: ### 1. Create a Google Cloud Project 1. Go to the [Google Cloud Console](https://console.developers.google.com/). 2. Create a new project (e.g., "My Smart Home"). 3. Enable the **Google Assistant API**.
Static analysis
No suspicious patterns detected.