ClawHub
Back to skill

Security audit

Mail Skill

Security checks for vulnerabilities and agentic risk

Overview

This mail skill is coherent, but it asks for powerful mailbox access and installs mutable remote code with weak safeguards.

Review carefully before installing. Use an isolated environment, pin and inspect the mail-mcp-server source before installation, avoid --break-system-packages, use an app password or scoped credential instead of a primary mailbox password, protect the mcporter config file, and require explicit confirmation before sending, deleting, moving, or changing mailbox folders.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:4
Finding
Installation Executes Unpinned Code from a Mutable Remote Repository<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:4-17` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High ### Vulnerable Code ```bash REPO_URL="https://github.com/AdJIa/mail-mcp-server.git" PACKAGE_NAME="mail-mcp" CONFIG_FILE="$HOME/.mcporter/mcporter.json" echo "=== Mail MCP 安装脚本 ===" # 检查 mail-mcp 是否已安装 if command -v mail-mcp &> /dev/null; then echo "✅ mail-mcp 已安装: $(which mail-mcp)" else echo "📦 正在安装 mail-mcp..." pip install git+$REPO_URL --break-system-packages -q ``` The same unsafe installation method is recommended in `SKILL.md:24-36`: ```bash pip install git+https://github.com/AdJIa/mail-mcp-server.git ``` ```bash git clone https://github.com/AdJIa/mail-mcp-server.git cd mail-mcp-server pip install -e . ``` ### Technical Analysis The installer retrieves and installs Python code directly from the default branch of an external Git repository. It does not pin the dependency to an audited commit, verify a cryptographic hash, or validate a signed release. Consequently, the code executed during installation can change after this Skill has been reviewed. Python package installation can execute attacker-controlled build backend or packaging logic. If the upstream repository, maintainer account, release process, or network trust assumptions are compromised, a subsequent invocation can execute a payload that was not present during the audit. The `--break-system-packages` option additionally bypasses protections intended to prevent pip from modifying a system-managed Python environment. This can overwrite or conflict with operating-system packages, expanding the potential impact beyond an isolated application environment. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its default branch. 2. The attacker adds malicious packaging or runtime code to the remote project. 3. A user runs `install.sh` or follows the installation command in `SKIL ...[truncated 1023 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the repository dependency to a specific, reviewed full commit hash rather than its mutable default branch: ```bash python -m pip install \ "git+https://github.com/AdJIa/mail-mcp-server.git@<FULL_AUDITED_COMMIT_HASH>" ``` 2. Prefer a versioned, signed release from a trusted package registry. Require hash verification through a locked requirements file: ```text mail-mcp==<AUDITED_VERSION> --hash=sha256:<EXPECTED_HASH> ``` 3. Verify release signatures or repository commit signatures before installation. 4. Remove `--break-system-packages`. Install into a dedicated virtual environment or another isolated runtime: ```bash python3 -m venv "$HOME/.local/share/mail-mcp/venv" "$HOME/.local/share/mail-mcp/venv/bin/python" -m pip install \ --require-hashes -r requirements.lock ``` 5. Display the exact version or commit being installed and require explicit user confirmation before downloading and executing external code. 6. Review and lock all transitive dependencies. Use automated dependency and provenance checks in the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:49
Finding
Documentation Directs Users to Store Mailbox Credentials in Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:49-61` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "mail-mcp": { "command": "mail-mcp", "env": { "IMAP_HOST": "your-imap-server.com", "IMAP_PORT": "993", "EMAIL_USER": "your-email@example.com", "EMAIL_PASSWORD": "your-password", "IMAP_SSL": "true", "SMTP_HOST": "your-smtp-server.com", "SMTP_PORT": "465", "SMTP_SSL": "true" } ``` ### Technical Analysis The documented configuration places the mailbox username and password directly in `~/.mcporter/mcporter.json`. The instructions do not require restrictive file permissions, secret-manager integration, runtime secret injection, or a dedicated least-privilege credential. Although the example contains placeholders rather than an embedded real secret, users following it are expected to replace those placeholders with live credentials. Those credentials then persist in plaintext and may be exposed to other local users or processes if permissions are permissive. They may also leak through backups, support bundles, synchronization services, accidental source-control commits, or diagnostic collection. Encryption of IMAP and SMTP connections does not protect credentials stored locally. The referenced SSL settings only protect data in transit. ### Attack Path 1. A user follows the documented configuration procedure and enters a real mailbox password in `~/.mcporter/mcporter.json`. 2. The configuration remains stored as plaintext without a documented permission check or secret-storage control. 3. A local process, another user with sufficient file access, an exposed backup, or an accidentally published configuration obtains the file. 4. The attacker extracts `EMAIL_USER` and `EMAIL_PASSWORD`. 5. The attacker authenticates to the configured IMAP or SMTP service, subject to provider-si ...[truncated 652 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not place reusable mailbox passwords directly in `mcporter.json`. Retrieve secrets at runtime from an operating-system keychain, credential manager, or dedicated secret-management service. 2. If environment variables are required by the MCP server, use a protected launcher that retrieves the secret and injects it only into the child process rather than persisting it in the JSON configuration. 3. Prefer provider-issued app passwords or scoped tokens over the account's primary password. Grant only the mailbox capabilities required by the Skill. 4. Where plaintext storage cannot be avoided, create the file with owner-only permissions and verify them before startup: ```bash chmod 600 "$HOME/.mcporter/mcporter.json" ``` 5. Warn users not to commit, synchronize, log, or include the configuration in support bundles and backups without appropriate encryption. 6. Document credential rotation and revocation procedures and recommend provider-side multifactor authentication. 7. Ensure errors and diagnostic output never include configuration values or process environment secrets. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Content
�安装**: 检查 mail-mcp 是否已安装，未安装则自动从 GitHub 安装
2. **发送邮件**: 支持纯文本、HTML、附件
3. **搜索邮件**: 按 folder、条件搜索邮件
4. **管理文件夹**: 列出、创建、删除、重命名文件夹
5. **邮件操作**: 标记已读/未读、星标、移动、复制、删除

## 安装检查

### 方式一：pip 安装（推荐）

```bash
pip install git+https://github.com/AdJIa/mail-mcp-server.git
```

### 方式二：本地安装

```bash
git clone https://github.com/AdJIa/mail-mcp-server.git
cd mail-mcp-server
pip install -e .
```

### 验证安装

```bash
which mail-mcp
# 应输出: /home/xxx/.local/bin/mail-mcp
```

## 配置

### mcporter 配置

在 `~/.mcporter/mcporter.json` 中添加：

```json
{
  "mcpServers": {
    "mail-mcp": {
      "command": "mail-mcp",
      "env": {
        "IMAP_HOST": "your-imap-server.com",
        "IMAP_PORT": "993",
        "EMAIL_USER": "your-email@example.com",
        "EMAIL_PASSWOR
Confidence
97% confidence
Finding
The skill explicitly recommends installing and auto-installing code directly from a GitHub repository using 'pip install git+https://...', which is a remote bootstrap pattern. This is dangerous because it pulls and executes unpinned third-party code at install time, increasing supply-chain risk and enabling malicious or compromised upstream code to run in the user's environment.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list includes broad generic terms such as 'mail', 'email', '附件', and '邮箱', which can cause the skill to activate in many unrelated contexts. In an agent setting, overbroad activation increases the chance of unintended invocation of mail-related capabilities, including access to sensitive mailbox data or sending actions without the user specifically intending to use this skill.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to place raw email credentials, including EMAIL_PASSWORD, into configuration without prominent security warnings, secret-handling guidance, or notice that mailbox contents may be transmitted through the MCP service. This creates a real risk of credential exposure, insecure storage, and unintended processing of highly sensitive email data.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script performs a direct `pip install` from a Git repository and uses `--break-system-packages`, which can modify the host Python environment in intrusive ways without obtaining explicit user consent or explaining the risks. In an agent-skill installation context, this is more dangerous because users may run the script as-is, trusting it to be routine setup, while it fetches and installs remote code with system-level side effects.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
The skill instructions and operational guidance are presented entirely in Chinese, which can impose a language requirement on users without opt-in. The file does not indicate that the skill is intentionally limited to a Chinese-speaking or region-specific audience, nor does it offer alternative language support.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill documents destructive operations such as deleting folders and deleting emails without any explicit warning, safeguard, or confirmation requirement. In an agent-driven workflow, this can lead to accidental irreversible mailbox changes if the skill is invoked incorrectly or misinterprets user intent.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The script's user-facing comments and output messages are written in Chinese throughout, with no option to select another language or indication that the skill is intentionally region-specific. This can violate language/locale policy when a skill imposes a language choice without user opt-in or documented justification.

Static analysis

No suspicious patterns detected.