ClawHub
Back to skill

Security audit

Gog Xiaoshu

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Google Workspace CLI wrapper, but it asks users to install an unpinned third-party CLI and authorize broad Google account access that can read and modify sensitive data.

Review the `gogcli` source and Homebrew formula before installing, authorize only the Google services you need, avoid blanket Workspace access for routine tasks, and revoke the OAuth grant when you no longer need the tool. Confirm any command that sends email, creates events, or changes Sheets data before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding
Unpinned Third-Party Homebrew Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium **Vulnerable Code:** ```yaml metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}} ``` ### Technical Analysis The skill directs users to install the `gog` executable from the third-party Homebrew tap `steipete/tap/gogcli`, but it does not pin the dependency to a reviewed version, commit, immutable artifact, or cryptographic checksum. Consequently, the executable installed in the future may differ from the implementation evaluated when this skill was published. This creates a supply-chain trust boundary outside the reviewed project. A compromise of the tap, its upstream release infrastructure, or the formula maintainers' credentials could cause Homebrew to download and execute a modified package. The audited repository contains no local implementation of `gog` or integrity information with which to verify the installed executable. No evidence was found that the current dependency is malicious. The vulnerability is the mutable, unverified dependency installation mechanism. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, an upstream release source, or credentials authorized to update the formula. 2. The attacker modifies the formula or referenced artifact so that it installs a malicious `gog` executable. 3. A user follows the skill's installation metadata and installs or upgrades `steipete/tap/gogcli`. 4. Homebrew retrieves the attacker-controlled version because the skill does not enforce a reviewed version or digest. 5. The malicious executable runs with the invoking user's local privileges. 6. When the user performs the documented OAuth setup or Workspace operations, the executable may access OAuth material and data made ...[truncated 745 chars]
Remediation
## Remediation Suggestions - Pin installation to a specific, reviewed `gogcli` release or immutable commit rather than relying on the mutable latest formula. - Verify downloaded artifacts with a published SHA-256 checksum and, where available, a maintainer signature or provenance attestation. - Prefer an official, independently verifiable distribution source with release signing and reproducible provenance. - Record the expected version and integrity digest in the skill metadata so future installations resolve to the same audited artifact. - Add an explicit upgrade process requiring review and checksum updates before adopting a new release. - Apply least privilege during OAuth authorization by enabling only the Google services and scopes required for the user's task. - Protect OAuth token storage with restrictive filesystem permissions and document how users can revoke credentials after suspected compromise.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.