ClawHub
Back to skill

Security audit

E-commerce Gmail Customer Service

Security checks across malware telemetry and agentic risk

Overview

This is a powerful Gmail customer-service automation skill, but its access, memory, sending, scheduling, and setup controls are clearly disclosed and purpose-aligned.

Install only for a dedicated support Gmail account, keep auto-send off until draft-only tests pass, review the category permission file before enabling any automatic sends, and periodically inspect or clear long-term memory. Store OAuth and merchant credentials only in approved secret stores, not in chat, Gmail, config files, or the skill directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The configured human-handoff phrase is a common natural-language expression that a customer could easily include in a normal reply, intentionally or accidentally. In this skill, that phrase appears to control escalation to manual handling, so ambiguity can let customers manipulate routing, disrupt automation, or cause unnecessary human-review workload and inconsistent case handling.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: ecommerce-gmail-customer-service
description: "Draft-first e-commerce Gmail support: triage customer threads, verify order and policy context, and create auditable drafts. Owners independently control ongoing draft-edit learning, existing long-term memory use, and category-based automatic sending."
version: 1.2.8
metadata:
  openclaw:
Confidence
78% confidence
Finding
The skill intentionally stores long-term memory and other runtime state derived from customer-service interactions, creating a real persistence risk even though the document says the data is redacted. Any persistent store tied to customer emails can accumulate sensitive business context or incomplete redaction artifacts, and retention is explicitly long-lived until the owner clears it.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.