saltshaer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:56 PM UTC
• Version: 1.0.1

Overview

This Google Workspace helper is coherent, but it combines an unpinned third-party install with broad Google account access and write/delete examples that need careful review.

Review the gog Homebrew source before installing, grant only the Google services you actually need, verify sheet IDs and ranges before using update/append/clear, and consider a dedicated or low-privilege Google account for automation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party Homebrew Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned dependency from a mutable third-party Homebrew tap **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}} ``` ### Technical Analysis The installation metadata delegates delivery of the `gog` executable to the third-party Homebrew tap `steipete/tap`. It does not specify an immutable release, source commit, checksum, or cryptographic signature. Consequently, the dependency installed in the future may differ from the version that was available when this Skill was audited. This creates a supply-chain trust boundary: compromise of the tap, its publishing credentials, the referenced formula, or its upstream release artifacts could cause users to install modified executable code. The risk is especially significant because the documented setup grants the CLI OAuth access to Gmail, Calendar, Drive, Contacts, Sheets, and Docs. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its maintainer account, formula source, or an artifact referenced by the formula. 2. The attacker publishes a modified `gogcli` package or changes the mutable formula to retrieve a malicious artifact. 3. A user follows the Skill installation metadata and installs `steipete/tap/gogcli`. 4. Homebrew executes installation logic and installs the attacker-controlled binary without verification against a Skill-pinned digest. 5. The user configures Google OAuth credentials and invokes the compromised CLI. 6. The malicious binary can access data and authorization material available to the process, subject to the local account permissions and granted OAuth scopes. ### Impact Assessment Successful exploitation could execute code with the privileges of the user run ...[truncated 679 chars]
• Remediation: ## Remediation Suggestions 1. Prefer an official, independently verified distribution channel for `gog` where one is available. 2. Pin the dependency to a specific immutable release or source commit rather than relying only on a mutable formula name. 3. Pin and verify a cryptographic SHA-256 digest for the downloaded artifact. If upstream provides signed releases, verify the signature against a documented trusted public key. 4. Review and lock the Homebrew formula and all transitive download locations used during installation. 5. Document the expected package version, checksum, publisher, and verification procedure in the Skill. 6. Grant only the Google Workspace service scopes needed for the intended task instead of authorizing all listed services by default. 7. Use a dedicated, least-privileged Google account where practical, periodically review OAuth grants, and revoke authorization when no longer required. 8. Re-audit the pinned dependency before upgrading to a new release or digest.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown lists commands that update, append, clear, and export data in Google Sheets and Docs, which can modify or overwrite user data or write files locally. Aside from a warning about sending mail and creating events, the description does not disclose the risks of these file/data-affecting operations.

Static analysis

No suspicious patterns detected.