ClawHub
Back to skill

Security audit

Google Sheets via gog

Security checks for vulnerabilities and agentic risk

Overview

This Google Sheets skill mostly does what it says, but it unnecessarily requires users to store a password-like secret in configuration before the skill can load.

Review this skill before installing. It appears purpose-aligned and does not contain executable payloads, but users should avoid putting real passwords or reusable secrets into ordinary OpenClaw config. Prefer removing the password requirement, using OAuth-only setup, and storing any needed secrets in a proper secret manager or environment reference with clear warnings.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:5
Finding
Unnecessary Plaintext Password Configuration Requirement<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:19-20`, and `SKILL.md:29-44` **Vulnerability Type**: Unnecessary collection and storage of plaintext sensitive credentials **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"📊","homepage":"https://github.com/steipete/gogcli","skillKey":"gogSheets","requires":{"bins":["gog"],"config":["skills.entries.gogSheets.config.login","skills.entries.gogSheets.config.password"]},"install":[{"id":"brew","kind":"brew","formula":"gogcli","bins":["gog"],"label":"Install gog (Homebrew)"}]}} ``` ```markdown - OpenClaw only loads this skill when `skills.entries.gogSheets.config.login` and `skills.entries.gogSheets.config.password` are both set. ``` ```json5 { skills: { entries: { gogSheets: { enabled: true, config: { login: "you@gmail.com", password: "app-specific-or-local-secret" } } } } } ``` ```markdown `login` and `password` are load-time gating requirements for OpenClaw. They make the skill eligible to load, but the sheet operations below still use local `gog` OAuth unless you later add separate automation around those config values. If you do not want to store raw secrets directly in `config`, prefer using `skills.entries.gogSheets.env` or `apiKey` alongside this config and keep prompts free of secrets. ``` ### Technical Analysis The skill metadata requires users to define `skills.entries.gogSheets.config.password` before the skill can load. The documentation then instructs users to place an application-specific or local secret directly in the OpenClaw configuration. This password is not required by the documented spreadsheet workflow. The same documentation explicitly states that sheet operations use local `gog` OAuth and that the configured `login` and `password` values are only load-time gating requirements. Consequently, the design collects a sensitive credential without using it to pr ...[truncated 2484 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove `skills.entries.gogSheets.config.password` from `metadata.openclaw.requires`. 2. Remove the password field from all configuration examples and prerequisites. 3. Gate skill availability only on requirements that are actually necessary, such as the presence of the `gog` binary. 4. Validate Google authorization through the CLI's OAuth state, for example by directing users to inspect `gog auth status`, rather than collecting an unrelated password. 5. If an account selector is needed, use a non-secret account identifier such as `GOG_ACCOUNT` or the documented `--account` option. 6. If future automation genuinely requires a secret, use a dedicated secret manager or an environment-variable reference. Do not store the raw value in ordinary configuration, examples, prompts, logs, or source-controlled files. 7. Document the minimum OAuth scopes required and continue recommending read-only authorization for inspection-only workflows. 8. Add a migration note instructing existing users to remove the obsolete password key and rotate any real credential previously stored there. 9. Ensure configuration diagnostics and logging redact all fields designated as secrets. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This markdown file includes authentication commands that use a local OAuth client secret file and add an account, but it does not warn users that these steps involve sensitive credentials and account authorization. For markdown files, omission of privacy or security warnings around credential-related behavior is in scope for missing user warnings.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:32