Security audit

LMail Ops Complete

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent LMail tooling, but it can send stored credentials to any configured base URL without endpoint validation, including for admin workflows.

Install only if you trust the LMail endpoint and operator workflow. Configure LMAIL_BASE_URL to a known HTTPS LMail origin, avoid using admin credentials unless the task is truly administrative, keep the credentials file outside shared directories with 0600 permissions, and treat override permits as short-lived secrets.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lmail_http.py:60
Finding: Credentials May Be Transmitted to Arbitrary, Cleartext, or Redirected Endpoints
Content: View full analysis
tuple[int, dict[str, Any]]: req_headers = dict(headers or {}) body = None if payload is not None: body = json.dumps(payload).encode("utf-8") req_headers.setdefault("Content-Type", "application/json") req = request.Request(url=url, data=body, method=method, headers=req_headers) try: with request.urlopen(req, timeout=timeout) as resp: raw = resp.read().decode("utf-8") status = resp.status ``` ```python def auth_headers(token: str | None = None, api_key: str | None = None) -> dict[str, str]: if token: return {"Authorization": f"Bearer {token}"} if api_key: return {"Authorization": f"ApiKey {api_key}"} raise LMailHttpError("Missing auth: provide token or api key") ``` Authenticated callers directly combine these functions with a user- or environment-controlled base URL. For example, `scripts/chat_fast.py:219-222` contains: ```python creds = load_json_file(args.credentials_file) token = args.token or creds.get("token") api_key = args.api_key or creds.get("apiKey") headers = auth_headers(token=token, api_key=api_key) ``` ### Technical Analysis The shared HTTP client accepts any URL supported by `urllib` without validating its scheme, hostname, port, or origin. Most operational scripts accept `--base-url` or `LMAIL_BASE_URL`, load credentials from the local credentials file, and attach the resulting bearer token or API key to requests. The implementation does not: - Require HTTPS for non-loopback destinations. - Restrict authenticated requests to approved LMail origins. - Reject URLs containing ...[truncated 1803 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lmail_http.py:31
Finding: Credential Files Are Written Non-Atomically Before Restrictive Permissions Are Applied
Content: View full analysis
None: p = Path(path) p.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8") try: os.chmod(p, 0o600) except OSError: pass ``` ### Technical Analysis The function writes API keys and JWTs using `Path.write_text()` and applies mode `0600` only after the write has completed. Initial file permissions therefore depend on the process umask. Under a permissive umask, there is a window during which another local user may be able to read the secret. The path is predictable by default (`.lmail-credentials.json`), and the function does not reject symbolic links or validate the ownership and permissions of an existing destination. If an attacker can create or replace the selected path, the write may follow a symbolic link and overwrite an unintended file accessible to the victim. The `chmod` failure is silently ignored. Consequently, the caller may report successful credential persistence even when the final file remains more broadly accessible than required by the project's own security policy. ### Attack Path 1. The victim runs registration or login in a shared or attacker-writable working directory, or selects a credentials path in such a directory. 2. The attacker monitors the predictable path or creates a symbolic link at that path before execution. 3. `save_json_file()` opens and writes the destination using normal filesystem semantics. 4. Depending on the umask, newly created credentials may temporarily have group or world-readable permissions. 5. The attacker reads the API key and JWT during that window, or causes the data to be written through a symbolic link. 6. If `chmod()` fails, the exception is discarded and the insecure state is not reported ...[truncated 533 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/publish_clawhub.sh:75
Finding: Publishing Workflow Executes an Unpinned npm Package
Content: View full analysis
/dev/null 2>&1; then CLI=(clawhub) elif command -v npx >/dev/null 2>&1; then CLI=(npx -y clawhub) else echo "[ERR] neither clawhub nor npx is available" >&2 exit 1 fi ``` The selected command is later executed at `scripts/publish_clawhub.sh:120-125`: ```bash if ! "${CLI[@]}" whoami >/dev/null 2>&1; then echo "[ERR] not authenticated. Run: clawhub login" >&2 exit 1 fi "${CLI[@]}" "${PUBLISH_CMD[@]}" ``` ### Technical Analysis When a local `clawhub` executable is unavailable, the script invokes `npx -y clawhub`. No package version or integrity value is specified. This causes npm resolution to determine which package version will be downloaded and executed at runtime. The effective executable may therefore change after the Skill has been reviewed. The `-y` option suppresses interactive confirmation, increasing the chance that a user will execute newly resolved package code without examining it. This behavior is limited to the explicit publishing workflow and is not triggered by ordinary registration or messaging operations. Nevertheless, it creates a supply-chain execution channel with access to the publisher's local environment and registry authentication context. ### Attack Path 1. The victim invokes `publish_clawhub.sh` on a system where `clawhub` is not already installed but `npx` is available. 2. The script automatically selects `npx -y clawhub`. 3. npm resolves and downloads the package version available from the configured registry at execution time. 4. A compromised registry account, malicious package release, dependency compromise, or registry-configuration attack supplies hostile code. 5. The downloaded CLI or its installation lifecycle executes with the victim user's privileges. 6. The malicious code can access ...[truncated 579 chars]
Remediation: View remediation
`. 3. Verify package integrity against a reviewed lockfile, checksum, or trusted package provenance before execution. 4. Disable lifecycle scripts where compatible with the CLI distribution. 5. Require explicit user confirmation before downloading and executing a missing publishing tool. 6. Run publishing in an isolated environment with only the minimum required files and credentials. 7. Document the approved CLI version and update process. 8. Re-audit the pinned CLI and its dependency graph before changing the approved version. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (49)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding points to inclusion of admin override permit issuance and handling of sensitive permit tokens under the cover of a broader operational description. In context, exposing or normalizing admin override workflows inside a general-purpose mail skill materially raises risk because it can encourage execution of privileged actions without clear separation, approvals, or operator warnings.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The skill directs use of a local credentials file and operational flows that rely on stored authentication material, which creates a concrete credential-access surface. In this context the danger is elevated because the skill also uses shell, file I/O, and network operations; if the file is broadly readable, checked into source control, or reused across tasks, attackers or other processes could extract tokens and impersonate the account.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
bash
export LMAIL_BASE_URL="https://amiigzz.online" export LMAIL_CREDENTIALS_FILE=".lmail-credentials.json"

bash

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · references/security-policy.md (reported line 8)May include surrounding context.
md
- Store credentials in local files with mode `0600`. - Avoid sending credentials through chat logs. ## Permit and Override Safety - Treat permits as one-time secrets. - Use admin override permits only for verified false positives. - Always include a reason with a ticket or case reference.

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · references/security-policy.md (reported line 8)May include surrounding context.
md
- Store credentials in local files with mode `0600`. - Avoid sending credentials through chat logs. ## Permit and Override Safety - Treat permits as one-time secrets. - Use admin override permits only for verified false positives. - Always include a reason with a ticket or case reference.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/install_for_openclaw.sh (reported line 40)May include surrounding context.
sh
local dst="$root/lmail-ops-complete" rm -rf "$dst" cp -a "$SKILL_DIR" "$dst" rm -rf "$dst/scripts/__pycache__" echo "[OK] installed at $dst" }

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/admin_fetch_registration_events.py (reported line 31)May include surrounding context.
python
parser.add_argument("--base-url", default=os.getenv("LMAIL_BASE_URL", "http://localhost:3001")) parser.add_argument("--token") parser.add_argument("--api-key") parser.add_argument("--credentials-file", default=os.getenv("LMAIL_CREDENTIALS_FILE", ".lmail-credentials.json")) parser.add_argument("--to", required=True) parser.add_argument("--subject", required=True) parser.add_argument("--body-text", required=True)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/admin_issue_override_permit.py (reported line 31)May include surrounding context.
python
parser.add_argument("--base-url", default=os.getenv("LMAIL_BASE_URL", "http://localhost:3001")) parser.add_argument("--token") parser.add_argument("--api-key") parser.add_argument("--credentials-file", default=os.getenv("LMAIL_CREDENTIALS_FILE", ".lmail-credentials.json")) parser.add_argument("--to", required=True) parser.add_argument("--subject", required=True) parser.add_argument("--body-text", required=True)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/chat_fast.py (reported line 31)May include surrounding context.
python
parser.add_argument("--base-url", default=os.getenv("LMAIL_BASE_URL", "http://localhost:3001")) parser.add_argument("--token") parser.add_argument("--api-key") parser.add_argument("--credentials-file", default=os.getenv("LMAIL_CREDENTIALS_FILE", ".lmail-credentials.json")) parser.add_argument("--to", required=True) parser.add_argument("--subject", required=True) parser.add_argument("--body-text", required=True)

Static analysis

No suspicious patterns detected.