ClawHub
Back to skill

Security audit

Gmail Last5

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it hardcodes a specific Gmail account and can reveal private inbox metadata without an explicit account-selection or confirmation step.

Review before installing, especially in shared environments. Use only where the configured gog Gmail credentials belong to the intended user, and prefer changing the skill to prompt for or confirm the account before querying and displaying email subjects.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:16
Finding

Hardcoded Gmail Account May Permit Unauthorized Mailbox Metadata Disclosure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–18
Vulnerability Type: Hardcoded account selection without an explicit authorization check
Risk Level: Medium

Vulnerable Code

bash
gog gmail search "in:inbox" --max 5 --json --results-only --account william.kettle@neuralshift.co.uk

Technical Analysis

The skill directs the agent to query a fixed Gmail account rather than selecting an account based on the invoking user's identity or requiring confirmation before access. It also instructs the agent to return the sender, subject, and date of the five newest inbox messages.

In a shared environment where gog already has valid credentials for the hardcoded account, a user who can invoke the skill may cause the agent to access and display mailbox metadata without demonstrating that they are authorized to view that mailbox. The command does not bypass Gmail authentication or acquire additional Gmail permissions; exploitation depends on valid credentials already being available to the agent process.

Attack Path

  1. An administrator or mailbox owner authenticates gog for william.kettle@neuralshift.co.uk in an environment accessible to the agent.
  2. Another user with access to that agent invokes /skill gmail_last5.
  3. The agent executes the hardcoded gog gmail search command using the existing credentials.
  4. Gmail returns the five newest inbox search results.
  5. The agent exposes message senders, subjects, and dates to the invoking user without a separate authorization check.

Impact Assessment

A successful exploit can disclose private email metadata, including correspondent identities, subject lines, and message timestamps, from the hardcoded mailbox. Subject lines may contain confidential business, personal, security, or account-related information.

The scope is limited to data accessible through the credentials and permissions already configured for gog. No evidence sh ...[truncated 156 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the hardcoded Gmail address from the skill command.
  2. Resolve the mailbox from the authenticated invoking user's approved account context.
  3. If multiple accounts are configured, list only authorized account identifiers and require the user to select and explicitly confirm one before querying it.
  4. Enforce server-side or agent-platform authorization so permission is not based solely on whether gog has cached credentials.
  5. Isolate Gmail credentials by user and avoid sharing credential stores across unrelated users or sessions.
  6. Apply least-privilege Gmail scopes and restrict the integration to read-only access when mailbox modification is unnecessary.
  7. Warn users that email metadata will be displayed, and consider redacting sensitive subject lines in shared channels.
  8. Record mailbox access in an audit log containing the invoking identity, selected account, time, and operation, while excluding message content and secrets.
  9. On command failure, do not reveal configured account identities to unauthorized users; direct them to an administrator or a secure account-selection workflow.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill retrieves and displays inbox email metadata, including sender and subject lines, which are privacy-sensitive and may expose confidential personal or business information to anyone invoking the skill or viewing its output. The risk is increased because the skill hardcodes a specific email account and provides no warning, confirmation, or consent step before accessing mailbox contents.

Content

No source excerpt is available for this finding.