ClawHub
Back to skill

Security audit

Gog Jasmine Yottol

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Google Workspace CLI helper, but it ships a real Google OAuth client credential file that is not disclosed or needed for the documented setup.

Review this before installing. The gog CLI use case is legitimate, but this package should not distribute a project-specific OAuth client secret. Prefer a version that removes credentials.json and requires you to supply your own Google OAuth client configuration. If you proceed, understand that authorizing Gmail, Calendar, Drive, Contacts, Sheets, and Docs grants broad access to your Google Workspace data and actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
credentials.json:1
Finding
Hardcoded Google OAuth Client Credentials Distributed in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `credentials.json`, line 1 **Vulnerability Type**: Hardcoded OAuth client secret / plaintext sensitive configuration **Risk Level**: Medium ### Vulnerable Code ```json {"installed":{"client_id":"499689166277-qmnt29oin521v8ko5l9h5qivvo34k3mo.apps.googleusercontent.com","project_id":"eco-league-491806-p1","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_secret":"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","redirect_uris":["http://localhost"]}} ``` ### Technical Analysis The project distributes a Google OAuth client ID and client secret directly in a plaintext JSON file. Anyone who downloads or otherwise obtains the Skill package can extract and reuse these values without authentication. Although OAuth credentials for an installed application do not independently grant access to a Google account, the exposed values identify and authenticate the registered OAuth client during applicable OAuth exchanges. An attacker could incorporate them into an attacker-controlled authorization flow, impersonate the registered client where provider controls permit, or abuse the associated Google Cloud project's identity, quotas, and reputation. The generic setup instructions in `SKILL.md` tell users to provide a client-secret file through `gog auth credentials /path/to/client_secret.json`; they do not require this particular credential to be bundled with the published project. Consequently, distributing `credentials.json` unnecessarily exposes project-specific sensitive configuration. ### Attack Path 1. An attacker downloads or gains read access to the published Skill package. 2. The attacker extracts the OAuth client ID, project ID, and client secret from `credentials.json`. 3. The attacker configures an OAuth client or compatible authorization tool with the exposed values and the registe ...[truncated 1526 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Revoke or rotate the exposed OAuth client secret in the relevant Google Cloud project because it has already been distributed. 2. Remove `credentials.json` from the project package, source repository, release archives, and publication artifacts. 3. Purge the credential from repository history and previously published versions where feasible. 4. Add `credentials.json`, `client_secret*.json`, OAuth token files, and similar sensitive artifacts to `.gitignore` and package-exclusion rules. 5. Require each operator to provide their own OAuth client configuration at deployment or setup time, consistent with the existing `gog auth credentials /path/to/client_secret.json` instructions. 6. Store credentials outside the project directory with restrictive filesystem permissions and inject their location through secure runtime configuration. 7. Add automated secret scanning to pre-commit hooks and CI/CD pipelines to prevent recurrence. 8. Review Google Cloud OAuth logs, quota usage, consent-screen configuration, authorized redirect URIs, and application status for evidence of misuse. 9. Restrict redirect URIs and requested OAuth scopes to the minimum required by the user's selected operations. 10. Avoid printing or reproducing the replacement secret in logs, diagnostics, documentation, or future audit artifacts. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.