The Agent Skills Directory

HIGH W007: Insecure credential handling detected in skill instructions.

Insecure credential handling detected (high risk: 1.00). The prompt explicitly asks the user to paste their Google OAuth credentials JSON (or provide its path) and includes commands that would write that JSON verbatim, which requires the LLM to handle and output secret credential material directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

Malicious code pattern detected (high risk: 1.00). This integration contains multiple high-risk, likely-abusive patterns: it instructs users to paste OAuth credentials into the chat, runs unvetted npx packages (remote code), instructs bypassing "unverified app" warnings, and mounts/stores Gmail tokens so the agent/container can autonomously read and send emails — enabling credential theft, supply-chain compromise, and data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (high risk: 0.95). The skill’s runtime path ingests outsider-authored free text via Gmail MCP when it fetches email bodies (e.g., checkForNewEmails() → mcp__gmail__get_email / search results) and then embeds <body>${email.body}</body> into the agent prompt; email content is authored by non-operating users.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

Potentially malicious external URL detected (high risk: 1.00). The skill executes the remote npm package at runtime via commands like "npx -y @gongrzhe/server-gmail-autoauth-mcp" (e.g., for auth and MCP calls), which fetches and runs code from the npm registry and is required for the Gmail integration.

MEDIUM W013: Attempt to modify system services in skill instructions.

Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs making persistent system changes (creating ~/.gmail-mcp, copying OAuth credentials, modifying code to mount that host directory into containers, rebuilding and restarting the service via launchctl) which alters the machine's state and exposes sensitive credentials to containers and agent tooling — even though it doesn't request sudo or create new users, these actions enable powerful persistent access and possible exfiltration.

add-gmail