Gmail Draft Initialize

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it can create persistent Gmail drafts through a broadly triggered shell command without clear confirmation or recipient validation.

Review before installing. This skill should only be used when you are comfortable letting an agent create Gmail drafts through the gog CLI. Prefer a version that requires explicit confirmation of the recipient list and passes recipients as structured process arguments rather than interpolating them into a shell command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:19

Finding

Command Injection Through Unsafe Recipient Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-24
Vulnerability Type: Command injection through unsafe shell-command construction
Risk Level: High

Vulnerable Code

markdown

## Cognitive Directives
WHEN [A new email needs to be drafted]
THEN [Execute the native terminal command `gog gmail drafts create --to "..." --json`]

## Schema Example
```json
{
  "command": "gog gmail drafts create --to \"[e-mail]\" --json"
}

text

### Technical Analysis

The skill directs the agent to place a recipient value inside a quoted terminal-command string. It does not require strict email-address validation, shell metacharacter rejection, escaping, or execution through an argument-array API.

If recipient data is attacker-controlled, a value containing quotation marks and shell syntax may terminate the intended `--to` argument and introduce additional shell operations. The terminal shell could then interpret those operations as commands rather than recipient data. The retry loop does not mitigate this issue and could cause a malicious input to be attempted repeatedly.

### Attack Path

1. An attacker supplies or influences the email recipient value used by the skill.
2. The agent substitutes that value into the documented `gog gmail drafts create --to "..." --json` command.
3. A maliciously constructed value escapes the quoted argument and introduces shell syntax.
4. The agent executes the resulting command through a terminal shell.
5. The shell runs the injected operation with the same operating-system privileges and environment access as the agent process.

### Impact Assessment

Successful exploitation could permit arbitrary local command execution under the agent's account. Depending on that account's privileges and environment, an attacker could read or modify accessible files, obtain locally available credentials or tokens, alter data, invoke other installed tools, or use the co
...[truncated 222 chars]

Remediation

View remediation

Remediation Suggestions

• Invoke gog through a structured process-execution API that accepts an executable and a separate argument array, such as ["gmail", "drafts", "create", "--to", recipient, "--json"]. Do not construct a shell command by concatenating user-controlled strings.
• Disable shell interpretation when launching the process.
• Parse and validate every recipient with a well-tested email-address parser before execution.
• Reject control characters, unexpected quotation marks, newlines, and shell metacharacters in recipient input.
• If multiple recipients are supported, parse them into individual validated addresses rather than passing an unverified combined string.
• If shell execution is unavoidable, apply platform-appropriate shell escaping after validation; escaping alone should not replace structured argument execution.
• Add tests covering quotation marks, command separators, command substitution syntax, newlines, and malformed email addresses.
• Ensure retry behavior only repeats validated, safely represented arguments and does not re-execute malformed attacker-controlled command strings.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

# Gmail Draft Initialize

This skill allows the agent to create a new, empty email draft in Gmail with specified recipients. It does NOT set the subject or body (use the dedicated update skills for those).

## Cognitive Directives
WHEN [A new email needs to be drafted]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs execution of a command that creates a Gmail draft but does not include an explicit user-facing disclosure that an external side effect will occur in the user's email account. Even though it only creates a draft, this still changes persistent state and may expose recipient data or create misleading artifacts if triggered unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition 'WHEN [A new email needs to be drafted]' is very broad and does not require explicit user confirmation, recipient validation, or tighter preconditions. In an agent setting, this can cause the skill to activate in ambiguous contexts and create drafts addressed to unintended recipients, which is risky because it performs an external side effect in the user's Gmail account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.