ClawHub
Back to skill

Security audit

AgentMail

Security checks across malware telemetry and agentic risk

Overview

AgentMail is a coherent email automation skill, but it handles sensitive email, API keys, webhooks, and optional third-party forwarding that users should configure carefully.

Install only if you intend to give an agent an email identity. Keep AGENTMAIL_API_KEY and any GITHUB_TOKEN secret, restrict webhook endpoints, verify webhook signatures, allowlist trusted senders, avoid logging full payloads in shared systems, and redact or approve email content before forwarding it to GitHub, Slack, or other services.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill instructs users to set and use an API key via environment variables and includes executable code snippets that read from the environment, but no explicit permission declaration accompanies those capabilities. In agent ecosystems, undeclared secret access weakens transparency and can cause a host to grant broader capabilities than users expect, especially in a skill that also handles inbound untrusted email and outbound messaging.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The example extends an email-handling skill into creating GitHub issues using repository credentials and untrusted email input. This is dangerous because it encourages developers to wire inbound email directly into a privileged third-party API, enabling data exfiltration, spam/abuse, and unauthorized issue creation if sender trust, authorization, and content filtering are not added.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The example forwards sender identity and full email body to GitHub without any privacy warning or consent checkpoint. That creates a real privacy and compliance risk because users may send sensitive operational, personal, or confidential information by email that then gets copied into another system with different visibility and retention rules.

Ssd 3

Medium
Confidence
96% confidence
Finding
The issue body republishes the original email and sender information into GitHub automatically, broadening exposure of user-supplied content. If the target repository is widely accessible or integrated with other tooling, sensitive data sent by email could be disclosed far beyond the original recipient set.

External Transmission

Medium
Category
Data Exfiltration
Content
'labels': labels
    }
    
    response = requests.post(
        f'https://api.github.com/repos/{repo}/issues',
        json=issue_data,
        headers={
Confidence
88% confidence
Finding
requests.post( f'https://api.github.com/repos/{repo}/issues', json=

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: agentmail
description: API-first email platform designed for AI agents. Create and manage dedicated email inboxes, send and receive emails programmatically, and handle email-based workflows with webhooks and real-time events. Use when you need to set up agent email identity, send emails from agents, handle incoming email workflows, or replace traditional email providers like Gmail with agent-friendly infrastructure.
---

# AgentMail
Confidence
83% confidence
Finding
Create and manage dedicated email inboxes, send and receive emails programmatically, and handle email-based workflows with webhooks and real-time events. Use when you need to set up agent email identi

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:89