ClawHub
Back to skill

Security audit

Gmail

Security checks for vulnerabilities and agentic risk

Overview

This Gmail skill is purpose-aligned, but it asks users to connect a sensitive mailbox through an unpinned external plugin and does not clearly define confirmation or scope safeguards for sending and trashing mail.

Review this before installing. Only use it if you trust the MorphixAI plugin and understand that it can access Gmail content and perform state-changing actions such as sending mail, marking messages read, and moving messages to trash. Prefer a pinned or otherwise verified plugin version, check the Gmail scopes during account linking, and require preview/confirmation before sending or trashing messages.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding
Unpinned Third-Party Plugin Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```sh openclaw plugins install openclaw-morphixai ``` ### Technical Analysis The documented installation command installs the `openclaw-morphixai` plugin without specifying an audited version, package digest, cryptographic signature, or explicitly trusted registry. Consequently, the dependency retrieved during installation can differ from the version that was originally reviewed. This creates a supply-chain risk: compromise of the package publisher, registry entry, distribution infrastructure, or a later plugin release could cause users to install attacker-controlled code. The risk is elevated because the plugin is intended to receive a MorphixAI API key and operate on a linked Gmail account. No evidence establishes that the current plugin is malicious. The vulnerability is the absence of controls ensuring that users install the same trusted plugin version that was audited. ### Attack Path 1. An attacker compromises the plugin publisher account, package registry entry, or release process. 2. The attacker publishes a malicious version under the expected `openclaw-morphixai` package name. 3. A user follows the Skill documentation and executes the unpinned installation command. 4. The package manager resolves the command to the attacker-controlled release. 5. The malicious plugin executes in the OpenClaw environment. 6. When the user configures `MORPHIXAI_API_KEY` and links Gmail, the plugin may access those credentials or abuse the permissions granted to the integration. ### Impact Assessment Successful exploitation could execute code with the privileges of the user running OpenClaw. Within the integration's granted authorization scope, a compromised plugin could potentially: - Read or exfiltrate Gmail messages and metadata. - Search sensitive mailbox content. - Send f ...[truncated 386 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the plugin to a specific, reviewed version rather than installing an implicitly selected release. 2. Retrieve the package only from an explicitly documented and trusted registry or repository. 3. Verify a cryptographic checksum or publisher signature before installation. 4. Maintain an allowlist of approved plugin names, versions, publishers, and integrity hashes. 5. Review the pinned plugin's source code and release artifacts before recommending it. 6. Document the Gmail OAuth scopes required by the plugin and grant only the minimum permissions necessary. 7. Run the plugin with restricted operating-system privileges and isolate it from unrelated credentials and files. 8. Establish an update process that requires security review before changing the pinned version. 9. Provide revocation and rotation procedures for the MorphixAI API key and linked Gmail authorization in case the dependency is compromised. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill exposes high-impact mailbox actions including reading message contents, sending mail, and trashing messages, but it does not present an explicit privacy, consent, or destructive-action warning to the user. In an agent context, this increases the risk of unintended disclosure of sensitive email data or unauthorized state-changing actions being taken without sufficient user awareness.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
The natural-language content of the skill is presented only in Chinese, including the description and operating instructions. Under the language/locale policy, a skill should not force a specific language without user opt-in unless the locale restriction is explicitly documented and justified.

Static analysis

No suspicious patterns detected.