ClawHub
Back to skill

Security audit

Google Workspace CLI (gws)

Security checks for vulnerabilities and agentic risk

Overview

This skill exposes Google Workspace through the official-style gws CLI and MCP, with broad account powers that are visible and purpose-aligned but require careful scope control.

Install only if you intend to let an agent work with your Google Workspace account. Prefer pinned or reviewed CLI versions, avoid all-services MCP mode, grant the smallest OAuth scopes possible, restrict MCP to needed services, and require explicit confirmation before sending email, sharing files, deleting or modifying data, or using Admin APIs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:45
Finding

Unpinned External Dependencies Permit Mutable Code Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
2. Enable Workspace APIs (Drive, Gmail, Calendar, etc.)
3. Create OAuth 2.0 Client ID (Desktop app type)
4. Download credentials JSON
5. Set: `export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/credentials.json`
6. Run: `gws auth login`

### Option C: Service Account (server/headless)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly advertises capabilities to read/send Gmail, modify calendars and sheets, and manage Drive, but it does not clearly warn users that these actions can modify data, share content, or send outbound communications on their behalf. In an agent context, this increases the risk of unintended side effects, especially when the tool is exposed through MCP and can be invoked programmatically across many Workspace APIs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.