T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_unseen.py:16- Finding
Credential Redirection Through Independently Overridable IMAP Host
- Content
View full analysis
- Remediation
View remediation
Security audit
Gmail-digester
Security checks for vulnerabilities and agentic risk
Overview
This Gmail digest skill mostly does what it says, but its credential handling can redirect stored email credentials to a host chosen by environment variables.
Review this before installing. Use a narrowly scoped Gmail app password, prefer environment variables over the config file, avoid setting IMAP_HOST unless you fully trust the server, and do not store the config file in a shared or synced location. Treat email content in summaries as untrusted because an email sender can put instructions in the message body.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:44- Finding
Plaintext Credential File Is Documented Without Permission Enforcement
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_unseen.py:126- Finding
Untrusted Email Content Is Passed to the Agent Without Prompt-Injection Isolation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose says the skill sends a digest, but the documented workflow includes fetching full unread email bodies, reading credentials from disk or environment, and returning raw JSON from the script. This mismatch is security-significant because it masks broader data access than the user-facing description implies, increasing the chance of over-collection and unintended disclosure of sensitive email contents.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow and output rules require the digest and summaries to be produced in Chinese, including a mandatory translation of email body summaries. This is a language-policy constraint applied without user opt-in or any documented regional justification.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md 5. If result is empty, send: 📭 近两日暂无未读邮件 ## Output Rules - Send the digest message ONLY. Do NOT add any extra comments, greetings, explanations, or follow-up questions before or after the digest. - Do NOT say things like "主人，以下是您的邮件摘要" or "如需了解详情请告知" etc. - The digest message itself is the complete and final response.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill requires access to environment variables, local files, and the network to read Gmail credentials and connect to an IMAP server, but it does not declare any explicit tool scope or allowed-tools boundary. That omission weakens reviewability and containment because a caller cannot easily verify what capabilities the skill is expected to exercise before running it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Broad trigger phrases like 'check my Gmail' or 'summarize my emails' can overlap with ordinary conversation and cause the skill to activate in contexts where the user did not intend credentialed mailbox access. Because this skill reads private email through IMAP, accidental invocation materially raises privacy and consent risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script reads sensitive credentials from environment variables and later uses them to authenticate to Gmail and fetch message content. Although the module docstring says it fetches unread Gmail, there is no explicit warning, prompt, or user-facing notice that credentials will be used and email body data will be transmitted and processed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
When environment variables are not present, the script loads a config file and reads IMAP username and password fields. This is sensitive credential access, but the code provides no confirmation, warning, or user-facing disclosure beyond an internal comment.
- Content