Email Helper Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:05 AM UTC
• Version: 2.0.0

Overview

This email helper is purpose-aligned but needs Review because it can access mailboxes, send email, persist message drafts locally, and permits SMTP login without TLS.

Review this before installing if you will use real mail accounts. Use only app-specific passwords or scoped credentials, keep TLS enabled, avoid sensitive draft content unless you understand it is stored locally in plaintext, and confirm any send or inbox-read action explicitly.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:76

Finding

SMTP Credentials and Email Content Can Be Transmitted Without Encryption

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76–92
Vulnerability Type: Optional plaintext SMTP authentication and transmission
Risk Level: High

python

def send(self, draft_id: int, smtp_host: str, smtp_port: int,
         username: str, password: str, use_tls: bool = True) -> dict:
    draft = next((d for d in self.drafts if d["id"] == draft_id), None)
    if not draft:
        return {"error": f"Draft #{draft_id} not found"}

    msg = self.build_mime(draft_id)
    if not msg:
        return {"error": "Failed to build MIME message"}

    try:
        server = smtplib.SMTP(smtp_host, smtp_port, timeout=10)
        if use_tls:
            server.starttls()
        server.login(username, password)
        server.send_message(msg)

Technical Analysis

The send method permits the caller to set use_tls=False. Authentication through server.login(username, password) and message transmission through server.send_message(msg) still occur when TLS is disabled.

SMTP authentication mechanisms frequently encode credentials but do not encrypt them. Without transport encryption, a network observer or a malicious intermediary can recover the username and password and inspect or modify recipient information, subjects, and message bodies. Network access is necessary for the declared email-sending functionality, but permitting unencrypted authentication is not necessary and violates secure minimum-privilege handling of mailbox credentials.

Attack Path

1. A user, integration, or unsafe configuration invokes send with use_tls=False.
2. The Skill opens a plaintext SMTP connection to the caller-specified host and port.
3. server.login() sends authentication data without a protected TLS channel.
4. A network-positioned attacker, compromised access point, or malicious SMTP endpoint captures the authentication exchange.
5. The attacker recovers the credentials and observes or ...[truncated 714 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the use_tls=False capability and require an encrypted transport before authentication.
• For implicit TLS endpoints, use smtplib.SMTP_SSL with ssl.create_default_context().
• For STARTTLS endpoints, create a verified SSL context, call starttls(context=context), and abort if negotiation or certificate validation fails.
• Authenticate only after successful TLS establishment.
• Validate SMTP hosts and ports against an explicit user-approved configuration when the surrounding platform supports destination restrictions.
• Prefer provider-scoped application passwords or OAuth tokens instead of reusable account passwords.
• Ensure errors do not expose credentials or other authentication material.
• Document that certificate verification must never be disabled.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27

Finding

Email Drafts Are Persisted in an Unprotected Plaintext File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27 and 40–58
Vulnerability Type: Insecure local storage of sensitive email data
Risk Level: Medium

python

DRAFT_FILE = os.path.join(os.path.dirname(__file__), "email_drafts.json")

def _save_drafts(self):
    with open(DRAFT_FILE, "w", encoding="utf-8") as f:
        json.dump(self.drafts, f, ensure_ascii=False, indent=2)

def create_draft(self, to_addr: str, subject: str, body: str,
                 cc: str = "", bcc: str = "") -> dict:
    draft = {
        "id": len(self.drafts) + 1,
        "to": to_addr,
        "cc": cc,
        "bcc": bcc,
        "subject": subject,
        "body": body,
        "status": "draft",
        "created": datetime.now().isoformat(),
    }
    self.drafts.append(draft)
    self._save_drafts()
    return draft

Technical Analysis

The Skill stores recipient addresses, CC and BCC addresses, subjects, and complete message bodies in email_drafts.json next to the Skill file. The file is written as plaintext without explicit permission controls, encryption, retention limits, or protection against inclusion in backups and package-distribution workflows.

Python's normal open(..., "w") behavior relies on the process environment and umask for the permissions of a newly created file. Consequently, the implementation does not guarantee that only the intended user can read the drafts. Storing the file in the package directory also increases the chance of accidental publication, synchronization, or access by another process operating on the installed package.

Local persistence supports the declared draft functionality, but unrestricted plaintext persistence is broader than necessary for that purpose.

Attack Path

1. A user creates a draft containing private recipients, BCC entries, business information, credentials, or other sensitive content.
2. create_draft adds all fields to the in- ...[truncated 1044 chars]

Remediation

View remediation

Remediation Suggestions

• Store drafts in an operating-system-appropriate, user-private application data directory rather than beside the Skill source.
• Create the parent directory with owner-only permissions, such as mode 0700 on supported systems.
• Create draft files atomically with owner-only permissions, such as mode 0600, rather than relying solely on the process umask.
• Use atomic replacement and restrictive permissions to prevent partial writes and permission regressions.
• Offer encryption at rest using a key held in the operating system credential store for drafts containing sensitive information.
• Provide explicit controls to disable persistence, delete all drafts, and configure retention periods.
• Exclude the draft file from source control, packaging, telemetry, synchronization, and diagnostic bundles.
• Avoid retaining sent-message bodies unless the user explicitly requests archival behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation keywords include very broad terms like "邮件" and "email", which can easily appear in normal conversation and unintentionally trigger a skill that can draft, read, and send email. Because this skill has access to sensitive messaging actions, accidental activation increases the risk of unintended data exposure or unauthorized email operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description does not warn users that it can send email via SMTP, read inbox contents via IMAP, and persist draft contents locally in a JSON file. Without clear disclosure, users may unknowingly expose credentials, message contents, or personal/business data to local storage and remote mail operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The visible user-facing description and headings are primarily in Chinese, and the file does not indicate that users may choose their preferred language or locale. This can be a language-policy issue when a skill implicitly constrains interactions to one language without opt-in or justification.

Content

No source excerpt is available for this finding.