ClawHub
Back to skill

Security audit

AgentMailer MCP

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AgentMailer MCP connector that uses OAuth and human approval, with no hidden scripts or credential-stealing instructions found.

Install this only if you want your agent to connect to AgentMailer. Review the OAuth permissions before approval, especially inbox creation or direct agent communication permissions, use the native OAuth flow instead of pasting tokens, and revoke the MCP connection if you no longer need it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Credential Access

High
Category
Privilege Escalation
Content
6. Call `list_inboxes`. An empty result is valid and is not a transport failure.
7. If a tool returns `forbidden`, compare the requested operation with the permissions returned by `auth_me`; do not retry with guessed organization or resource identifiers.

Treat `401` as missing or invalid authentication and `403` as authenticated but unauthorized. `human_approval_required` specifically means the approval ceremony is incomplete. Do not expose access tokens, authorization headers, approval codes, or reviewer credentials in diagnostics.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
`https://api.agentmailer.ai/mcp`

Prefer the client's native remote-MCP configuration so it can discover OAuth from AgentMailer's protected-resource metadata. Do not ask the user to paste OAuth tokens into prompts, source files, or shell history.

## Connect
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill enables implicit invocation for an external MCP connector without any visible trigger constraints or narrowing conditions. That increases the chance the agent will contact the remote AgentMailer service automatically during normal conversation flow, potentially causing unintended authentication prompts, metadata disclosure, or external actions without sufficiently explicit user intent.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Public endpoints

- MCP: `https://api.agentmailer.ai/mcp`
- OAuth protected-resource metadata: `https://api.agentmailer.ai/.well-known/oauth-protected-resource`
- Canonical signup and connection guide: `https://api.agentmailer.ai/llms.txt`
- AgentMailer authentication guide: `https://api.agentmailer.ai/auth.md`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.