ClawHub
Back to skill

Security audit

Gmail Draft Update Subject

Security checks for vulnerabilities and agentic risk

Overview

The skill is narrowly aimed at updating Gmail draft subjects, but its shell command template can mishandle draft IDs or subjects and may allow unintended local command execution.

Review this before installing. The Gmail update itself is purpose-aligned, but it should only be used where the agent invokes `gog` safely with separate arguments or validated inputs, not by concatenating a shell command string from untrusted draft IDs or subject text.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:20
Finding

Shell Command Injection Through Unvalidated Gmail Draft Parameters

Content
View full analysis
--subject "..." --json`] ## Schema Example ```json { "command": "gog gmail drafts update draft_id_123 --subject \"Invoice\" --json" } ``` ### Technical Analysis The skill instructs the agent to construct and execute a terminal command by interpolating a Gmail draft ID and subject into a command string. The draft ID is unquoted, while the subject is merely enclosed in shell double quotes. No input validation, argument-array execution, or shell-safe escaping is required. If either parameter contains shell metacharacters, the shell may interpret part of the supplied value as additional syntax rather than as a literal `gog` argument. For example: - A draft ID containing `; id` could terminate the intended command and start another command. - A subject containing a closing quote followed by `; id; #` could escape its quoted context and append another command. Double quotes alone are insufficient because embedded quotes, command substitutions, and certain shell expansions can alter command interpretation. ### Attack Path 1. An attacker or untrusted upstream source supplies a malicious Gmail draft ID or subject. 2. The agent follows the skill directive and places that value into the documented command template. 3. The resulting command is submitted to a native terminal or shell. 4. The shell parses attacker-controlled metacharacters as command syntax. 5. An unintended command executes under the same operating-system identity and environment as the agent. ### Impact Assessment Successful exploitation could execute arbitrary local commands with the privileges of the agent process. This may permit access to files, environment variables, locally stored credentials, and authentication material availab ...[truncated 457 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.