Agentmail

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:49 AM UTC
• Version: 0.1.1

Overview

This skill does what it claims, but it gives an agent autonomous email powers while storing a long-lived API key in plaintext and running an unpinned MCP package.

Review this skill before installing. Use it only if you want an agent to control a dedicated email identity that can send messages, receive verification codes, and download attachments. Prefer a pinned and reviewed `agentmail-mcp` version, protect `~/.hermes/config.yaml` with strict permissions or a secrets manager, rotate/revoke the API key if exposed, and require explicit confirmation before outbound email, forwarding, service sign-ups, authentication flows, or attachment downloads from untrusted senders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:41
• Finding: Unpinned Third-Party Packages Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:41-44` and `SKILL.md:111-112` **Vulnerability Type**: Insecure dependency installation and execution **Risk Level**: High ### Vulnerable Code `SKILL.md:41-44`: ```yaml agentmail: command: "npx" args: ["-y", "agentmail-mcp"] env: ``` `SKILL.md:111-112`: ```text - The `mcp` Python package must be installed: `pip install mcp` - Real-time inbound email (webhooks) requires a public server — use `list_threads` polling via cronjob instead for personal use ``` ### Technical Analysis The MCP configuration invokes `npx -y agentmail-mcp` without specifying a reviewed package version or verifying an integrity digest. If the package is not already available locally, `npx` can retrieve it from the configured npm registry. The `-y` option suppresses the interactive installation prompt, allowing the retrieved package to execute automatically when Hermes starts the MCP server. The documented `pip install mcp` command is similarly unpinned. Its resolved version and transitive dependency graph can change over time without any corresponding change to this audited skill. Neither installation path specifies hashes, a lockfile, or another integrity control. This does not establish that the current packages are malicious. It creates a supply-chain exposure in which a compromised maintainer account, registry, package release, or transitive dependency could cause future users to retrieve attacker-controlled code. ### Attack Path 1. An attacker compromises the relevant package publishing account, package registry entry, or a transitive dependency. 2. The attacker publishes a malicious version under the package name used by the skill. 3. A user follows the setup instructions or restarts Hermes with the documented MCP configuration. 4. `npx -y` resolves, downloads, and executes the unpinned `agentmail-mcp` package without an installation confirmation. 5. Alternatively, ...[truncated 886 chars]
• Remediation: ## Remediation Suggestions - Pin `agentmail-mcp` to a specifically reviewed version, for example by using an exact version rather than an unconstrained package name. - Remove `-y` where feasible so unexpected installation is not silently accepted. - Install dependencies as a separate, explicit setup step and run the MCP server from a locked local installation. - Commit and enforce an npm lockfile for a wrapper project if the platform supports it. - Pin the Python `mcp` package and its transitive dependencies to reviewed versions. - Require package hashes for Python installation, such as through a hash-locked requirements file and `pip install --require-hashes`. - Verify package provenance, maintainers, signatures or attestations, and integrity digests before deployment. - Run the MCP server under a dedicated, minimally privileged account or sandbox with restricted filesystem and network access. - Establish dependency update review and vulnerability-monitoring procedures rather than automatically consuming new releases.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37
• Finding: AgentMail API Key Is Persisted in Plaintext Configuration## Vulnerability Details **File Location**: `SKILL.md:37-44` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```yaml mcp_servers: agentmail: command: "npx" args: ["-y", "agentmail-mcp"] env: AGENTMAIL_API_KEY: "am_your_key_here" ``` The setup instructions direct the user to replace the placeholder with the actual API key in `~/.hermes/config.yaml`. ### Technical Analysis The documented configuration stores the AgentMail API key directly in a plaintext YAML file. Any local user, process, backup system, diagnostic collector, or synchronization service able to read that file can recover the credential. The document does not instruct users to restrict file permissions or use a credential manager. The example contains only a placeholder and does not expose a real credential in the project itself. The vulnerability arises from the prescribed deployment practice, which causes users to persist the real secret in plaintext. Because the API key is passed to the MCP server through its environment, it may also be exposed to child processes, crash reports, debugging tools, or process-inspection mechanisms available under applicable operating-system permissions. ### Attack Path 1. A user replaces `am_your_key_here` with a valid AgentMail API key as instructed. 2. The key is saved in plaintext in `~/.hermes/config.yaml`. 3. An attacker gains read access through permissive file permissions, another process running as the user, a leaked backup, accidental configuration sharing, or compromise of the local account. 4. The attacker extracts the API key. 5. The attacker authenticates to AgentMail or configures another compatible client with the stolen credential. 6. The attacker performs operations permitted by that API key until it is revoked or expires. ### Impact Assessment Depending on the AgentMail authorization scope, credential theft cou ...[truncated 633 chars]
• Remediation: ## Remediation Suggestions - Store the API key in an operating-system credential store, encrypted secret manager, or another dedicated secrets facility rather than directly in the YAML file. - Add support for secure runtime secret injection so the key does not need to be persisted in the Hermes configuration. - If plaintext configuration cannot be avoided, restrict `~/.hermes/config.yaml` to the owning user, such as mode `0600` on Unix-like systems, and ensure the containing directory is not accessible to other users. - Exclude the configuration from source control, cloud synchronization, logs, support bundles, and unencrypted backups. - Avoid exposing the credential through command-line arguments or diagnostic output. - Use a narrowly scoped key if AgentMail supports scopes, and separate credentials across environments or agents. - Rotate the credential periodically and immediately after suspected disclosure. - Document key revocation and incident-response procedures. - Run the MCP server with least privilege and prevent unrelated child processes from inheriting the secret where practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This skill enables autonomous sending, receiving, and downloading of email content and attachments, including communication with external recipients, but it does not warn about privacy, consent, data exfiltration, attachment safety, or irreversible external side effects. In this context, the agent is given its own communication channel, so absent guardrails it could disclose sensitive data, spam third parties, or ingest malicious attachment content.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 1. Get an API Key
- Go to https://console.agentmail.to
- Create an account and generate an API key (starts with `am_`)

### 2. Configure MCP Server
Add to `~/.hermes/config.yaml` (paste your actual key — MCP env vars are not expanded from .env):

• Confidence: 84% confidence
• Finding: The skill tells users to place a long-lived API key directly into `~/.hermes/config.yaml`, creating persistent credential storage that may be readable by other local users, included in backups, or accidentally committed or shared. Because this key authorizes mailbox creation, message sending, and message retrieval, theft of the stored secret could allow full abuse of the agent-owned email account.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs users to run an MCP server via `npx -y agentmail-mcp` without pinning an exact package version. This creates a supply-chain risk: a future malicious or compromised release could be fetched and executed automatically in the local environment, and because the server is configured with the AgentMail API key, compromise could expose credentials or enable unauthorized email actions.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The instruction `pip install mcp` installs an unpinned dependency from the package index, which can lead to non-reproducible installs and exposure to malicious or compromised future releases. Although this is less directly dangerous than executing an MCP server package, it still expands the attack surface in the user's Python environment.

Static analysis

No suspicious patterns detected.