ClawHub
Back to skill

Security audit

AgentMailer Email Router

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AgentMailer email compatibility router with expected email read/write capability, not hidden or unrelated behavior.

Install this only if you intend to let the agent work with AgentMailer mailboxes, including potentially sending messages and deleting threads or drafts. Prefer the focused read-only or send-email skills for new workflows, and require clear user confirmation for outbound or destructive email actions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest presents this skill as a routing-only component, but it declares an MCP dependency that can directly read, draft, and send email. That over-privileges the skill relative to its stated purpose, increasing the risk that prompt injection, misrouting, or future implementation changes could invoke sensitive mail actions from a component users would reasonably expect to be non-executing.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
A skill whose documented purpose is only to route requests should not itself possess mutating email capability such as drafting or sending. If the router is ever induced to call the tool directly, an attacker could turn what appears to be a harmless dispatch layer into a path for unauthorized outbound email or message tampering.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "agentmailer"
      description: "Read, draft, and send AgentMailer email"
      transport: "streamable_http"
      url: "https://api.agentmailer.ai/mcp"
policy:
  allow_implicit_invocation: false
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.