ClawHub
Back to skill

Security audit

Gmail Draft Update Body

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear Gmail draft-editing purpose, but its command-string instructions create a real command-injection risk when draft IDs or body text are dynamic.

Review before installing. This skill should be changed to require a shell-free argv call such as gog with separate arguments for draftId and body, and should validate draft IDs. Avoid using it on draft bodies or identifiers influenced by untrusted content unless the execution environment guarantees literal argument passing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:20
Finding

Shell Command Injection Through Unsafely Interpolated Gmail Draft Parameters

Content
View full analysis
--body "..." --json`] ## Schema Example ```json { "command": "gog gmail drafts update draft_id_123 --body \"Please review the attached invoice.\" --json" } ``` ``` ### Technical Analysis The skill instructs the agent to construct and execute a terminal command by placing the draft identifier and message body directly into a command string. It does not require an argument-array execution API, define validation rules for `draftId`, or specify robust shell escaping for the body. Wrapping the body in double quotes is not sufficient protection when a shell interprets the resulting string. An attacker-controlled value can contain a closing quote, command substitution syntax, shell metacharacters, or other shell-specific constructs. These characters may terminate the intended argument and introduce an additional command. The draft identifier is similarly represented as a directly substituted command token without validation. The documented retry loop may cause a failed maliciously constructed command to be executed repeatedly, although successful injected commands would depend on how the calling agent evaluates failure and retries. ### Attack Path 1. An attacker influences the draft body or draft identifier supplied to the skill. 2. The attacker includes shell syntax designed to escape the intended command argument, such as a closing quote followed by a command separator and another command. 3. The agent interpolates the value into the documented `gog gmail drafts update` command. 4. The agent executes the constructed string through a shell-capable terminal interface. 5. The shell pars ...[truncated 1059 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.