ymailink

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.1.1

Overview

This email skill is purpose-aligned but needs review because it directs mutable remote installs and handles sensitive mailbox actions and AI processing of email content.

Install only from a version or commit you trust, preferably in a virtual environment, and avoid the Gitee mirror unless you can verify it matches the intended upstream. Treat ~/.config/ymailink config files, OAuth tokens, and AI API keys as sensitive credentials. Use keyring or pass instead of plaintext passwords, be careful with purge/delete/send commands, and do not use AI summaries on confidential or regulated email unless the AI endpoint and its data handling are approved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19
• Finding: Unpinned installation from mutable remote Git repositories## Vulnerability Details **File Location**: `SKILL.md:19-40` **Vulnerability Type**: Supply-chain exposure through mutable remote dependencies **Risk Level**: High ### Vulnerable Code ```bash pip install git+https://github.com/lizhisec/ymailink.git ``` ```bash # Install with all optional dependencies pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[all]" # Or install specific extras pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[outlook,gmail,keyring,exchange,ai]" ``` ```bash pip install git+https://gitee.com/w3hsec/ymailink.git ``` ```bash # With optional dependencies pip install "git+https://gitee.com/w3hsec/ymailink.git#egg=ymailink[all]" ``` ### Technical Analysis The installation instructions retrieve and execute Python package installation logic directly from mutable Git repository heads. No immutable commit, signed release, package hash, or other integrity constraint is specified. Consequently, the effective code installed by these commands can change after the Skill has been reviewed. The fallback repository is hosted under a different account and no documented trust relationship or synchronization verification is provided. This expands the supply-chain trust boundary and creates an additional compromise point. Installation of a Python package can execute build-backend logic, while the installed CLI executes with the invoking user's permissions. Because this CLI handles mailbox credentials, OAuth tokens, API keys, and email contents, compromise of the dependency could expose particularly sensitive data. ### Attack Path 1. An attacker compromises the GitHub repository, the Gitee mirror, a maintainer account, or the repository publishing process. 2. The attacker modifies the package source or installation/build configuration with malicious code. 3. The user or Agent follows the Skill instructions and installs the current mutable repository head ...[truncated 1188 chars]
• Remediation: ## Remediation Suggestions 1. Replace branch-head installation with a reviewed, immutable release or exact commit: ```bash pip install "git+https://github.com/lizhisec/ymailink.git@<reviewed-commit-hash>" ``` 2. Prefer a verified package registry release with an exact version and published cryptographic hashes. 3. Use hash-checked lock files or `pip --require-hashes` where practical. 4. Sign releases and verify signatures or attestations before installation. 5. Pin all direct and transitive dependencies used by optional extras. 6. Document the ownership and synchronization process for the Gitee mirror. Do not treat it as an automatic fallback unless its contents are verified against the approved upstream revision. 7. Install into an isolated virtual environment under an unprivileged account. 8. Review package source and build metadata before approving a new release or commit.

other

Warning

• Location: SKILL.md:116
• Finding: Full email content transmitted to an external AI service without explicit per-use safeguards## Vulnerability Details **File Location**: `SKILL.md:116-122`, `SKILL.md:307`; `references/configuration.md:289-326` **Vulnerability Type**: Sensitive data disclosure to an external service **Risk Level**: Medium ### Vulnerable Code ```markdown ### `ai` — AI-powered email operations | Subcommand | Action | |------------|--------| | `ai short-summary <id> [-f FOLDER]` | One-line email summary | | `ai summary <id> [-f FOLDER]` | Detailed email summary | | `ai rapid-reply <id> [-f FOLDER]` | Quick reply suggestions (3) | **Note:** AI features require `[ai]` section in config (see `references/configuration.md`) and the `ai` extra: `pip install ymailink[ai]`. All three commands fetch the target email, send it to the AI API (`https://ai.ymailink.com`), and print the result. ``` ```toml [ai] api-key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" # base-url = "https://ai.ymailink.com" # optional, this is the default # model = "auto" # optional, this is the default ``` ```markdown | Field | Required | Default | Description | |-------|----------|---------|-------------| | `api-key` | **Yes** | — | AI API key for authentication | | `base-url` | No | `https://ai.ymailink.com` | AI API base URL | | `model` | No | `auto` | Model identifier (e.g. `gpt-4o`, `claude-3.5-sonnet`) | ``` ```markdown All three commands fetch the email by ID from the configured account, send it to the AI API, and print the result. The `-f/--folder` flag specifies which folder to look in (default: `INBOX`). ``` ### Technical Analysis The AI functionality intentionally retrieves a selected email and transmits it to an external API. This network behavior is disclosed and is functionally necessary for remote AI processing; therefore, the audit does not establish covert exfiltration. However, the instructions do not state that the content is minimized or redacted, so the documented behavior indicat ...[truncated 2661 chars]
• Remediation: ## Remediation Suggestions 1. Require clear, informed confirmation before the first external AI request and before processing messages classified as sensitive. 2. Display the destination hostname and identify exactly which message fields will be transmitted. 3. Minimize requests to only the content required for the selected operation; omit unnecessary headers, quoted history, tracking data, and attachments. 4. Add configurable redaction for credentials, API keys, authentication links, one-time codes, financial data, and personal identifiers. 5. Provide a preview or dry-run mode showing the payload before transmission. 6. Support a local model or a documented self-hosted endpoint for users who cannot send mail to third parties. 7. Publish and link the default service's retention, deletion, training-use, subprocessors, jurisdiction, and privacy policies. 8. Validate configured endpoints, require HTTPS, and warn clearly when the hostname differs from the approved default. 9. Avoid forwarding the configured API key across redirects or to a host other than the explicitly configured endpoint. 10. Add administrative controls to disable AI processing for specific accounts, folders, domains, or message classifications.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger text is extremely broad and directs invocation for essentially any terminal-email topic, including credentials, OAuth, automation, attachments, and AI summaries. In an agent setting, this can cause the skill to activate when a safer, narrower workflow would be preferable, increasing the chance of exposing sensitive email content or steering users into high-risk operations unnecessarily.

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match

Content

OAuth2 (device flow) |
| **Gmail** (Google API) | google-api-python-client | google-api-python-client | OAuth2 (local server) |
| **Exchange** | exchangelib | exchangelib | password (auto/NTLM/basic) |

## Installation

**Before using any ymailink commands, always verify ymailink is installed first.** Run `which ymailink` or `ymailink --version`. If not installed, guide the user to run:

```bash
pip install git+https://github.com/lizhisec/ymailink.git
```

To install with optional dependencies (for specific backends or AI features):

```bash
# Install with all optional dependencies
pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[all]"

# Or install specific extras
pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[outlook,gmail,keyring,exchange,ai]"
```

If GitHub is inaccessible, use Gitee mirror as the git source:
```bash
pip install git+https://gitee.com/w3hsec/ymailink.git
```

```bash
# With optional dependencies
pip install "git+https:/

• Confidence: 95% confidence
• Finding: The skill instructs users to install directly from remote Git repositories via 'pip install git+https://...' from GitHub or a Gitee mirror. Installing executable code straight from mutable remote VCS sources bypasses stronger supply-chain controls such as pinned releases, reproducible hashes, and repository trust validation, creating a meaningful remote code execution and dependency-supply-chain risk.

Credential Access

High

• Category: Privilege Escalation

Content

pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[all]"

# Or install specific extras
pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[outlook,gmail,keyring,exchange,ai]"
```

If GitHub is inaccessible, use Gitee mirror as the git source:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[all]"

# Or install specific extras
pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[outlook,gmail,keyring,exchange,ai]"
```

If GitHub is inaccessible, use Gitee mirror as the git source:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[all]"

# Or install specific extras
pip install "git+https://github.com/lizhisec/ymailink.git#egg=ymailink[outlook,gmail,keyring,exchange,ai]"
```

If GitHub is inaccessible, use Gitee mirror as the git source:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

ymailink account configure
```

This prompts for account details and prints the resulting TOML config to stdout. **It does not write the file** — you need to copy-paste the output to `~/.config/ymailink/config.toml`.

See `references/configuration.md` for manual config setup with all backend types (IMAP/SMTP, Outlook, Gmail, Gmail-via-IMAP, Exchange), password auth methods (raw/cmd/keyring), OAuth2 token management, folder aliases, signatures, download directories, and proxy support.

• Confidence: 81% confidence
• Finding: The interactive configuration workflow prints account configuration, potentially including sensitive credentials or server details, directly to stdout for manual copy-paste into a persistent config file. This increases exposure through terminal scrollback, shell logging/recording, clipboard history, and durable local storage of secrets.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Folder counts** (count, unread) are only populated by Outlook, Gmail, and Exchange backends — IMAP does not fetch them.
- **Store passwords securely** using `pass`, system keyring (`pip install ymailink[keyring]`), or a command that outputs the password. Plaintext passwords in config are for testing only.
- **AI features** require `pip install ymailink[ai]` and an `[ai]` section in config with an `api-key`. The default AI endpoint is `https://ai.ymailink.com`.
- **OAuth2 tokens** are cached in `~/.config/ymailink/tokens/{provider}_{account}.json` (chmod 0600). Delete the file to force re-authorization.
- **Proxy support** for Outlook and Gmail backends: set `HTTPS_PROXY` or `https_proxy` environment variable.
- **Account not found** errors produce unhandled exceptions. Verify account names with `ymailink account list`.
- **Config file not found** returns an empty config (no error). Commands will fail with "No accounts configured" rather than a file-not-found error.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

```

**Setup steps:**
1. Create a project in Google Cloud Console
2. Enable the Gmail API
3. Create OAuth2 credentials (Desktop application type)
4. Download credentials and copy client-id / client-secret into config

• Confidence: 74% confidence
• Finding: The guidance instructs users to copy a Google OAuth client ID and client secret into a local config file, and the surrounding text documents persistent OAuth token caching on disk. For a terminal email client handling sensitive mail, local persistence of OAuth secrets and refreshable tokens increases the risk of account compromise if the config directory is exposed, backed up insecurely, or accessible to other local users/processes.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

- On first use, a browser window opens for authorization
- Tokens are cached in `~/.config/ymailink/tokens/`
- Tokens are refreshed automatically when expired
- To re-authorize, delete the token file and run any command

Token file paths:
- Outlook: `~/.config/ymailink/tokens/outlook_<account_name>.json`

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation states that AI commands fetch an email and send it to an external AI API, but it does not present a clear privacy, confidentiality, or data-handling warning before encouraging use. In an email-management skill, this is materially risky because users may submit sensitive message bodies, attachments, or regulated content to a third-party service without informed consent or policy review.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: This markdown file includes concrete commands for sending email via file or stdin, which transmits user-provided message bodies and recipient addresses. The surrounding documentation explains how to send mail but does not include any warning or disclosure about data transmission or the consequences of sending to real recipients.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The programmatic template workflow culminates in `ymailink template send`, which appears to perform a live send operation. Although a separate draft-saving section exists later, this section does not explicitly warn that `template send` will transmit the message, which could matter in automation contexts.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/configuration.md:96