Mail Invoice Archiver

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:58 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for mailbox invoice archiving, but it needs Review because syncing follows invoice links from email by default with weak URL scoping and unsafe download limits.

Install only if you are comfortable granting mailbox access and local archive writes. Prefer system credential storage or prompt mode, avoid plaintext config and command-line secrets, and run sync with link-following disabled or with a narrowly trusted link policy until URL validation and download-size limits are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mail_invoice_archiver/archive.py:557

Finding

Unrestricted invoice-link fetching enables server-side request forgery and resource exhaustion

Content

View full analysis

list[str]: urls = URL_PATTERN.findall(message.body_text) if not urls: return [] if not config.download_link_domains: return urls filtered: list[str] = [] for url in urls: for domain in config.download_link_domains: if domain in url: filtered.append(url) break return filtered ``` ```python # scripts/mail_invoice_archiver/archive.py:105-107 if follow_links: for url in extract_urls(message, config): downloaded = _download_link_if_invoice_like(url) ``` ```python # scripts/mail_invoice_archiver/archive.py:557-577 def _download_link_if_invoice_like(url: str) -> AttachmentPayload | str | None: parsed = urllib.parse.urlparse(url) path = parsed.path.lower() if not path.endswith((".pdf", ".xml", ".ofd", ".zip", ".png", ".jpg", ".jpeg")): return None request = urllib.request.Request(url, headers={"User-Agent": "mail-invoice-archiver/1.0"}) try: with urllib.request.urlopen(request, timeout=20) as response: data = response.read() content_type = response.headers.get_content_type() except urllib.error.URLError as exc: return str(exc) filename = Path(parsed.path).name or "downloaded-file" return AttachmentPayload( part_re ...[truncated 3344 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mail_invoice_archiver/config.py:160

Finding

Mailbox credentials can be exposed through command-line arguments and insecure plaintext configuration permissions

Content

View full analysis

Path: path = config_path or default_config_path() ...[truncated 4398 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (59)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation introduces Feishu credential loading and external integration behavior that is outside the manifest's mailbox invoice-archiving purpose. Undeclared secondary integrations expand the trust boundary and may cause the skill to access or transmit data to an unrelated external platform, surprising users and increasing data-exfiltration and secret-handling risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation introduces Feishu credential loading and external integration behavior that is outside the manifest's mailbox invoice-archiving purpose. Undeclared secondary integrations expand the trust boundary and may cause the skill to access or transmit data to an unrelated external platform, surprising users and increasing data-exfiltration and secret-handling risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill documentation introduces Feishu credential loading and external integration behavior that is outside the manifest's mailbox invoice-archiving purpose. Undeclared secondary integrations expand the trust boundary and may cause the skill to access or transmit data to an unrelated external platform, surprising users and increasing data-exfiltration and secret-handling risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill documentation introduces Feishu credential loading and external integration behavior that is outside the manifest's mailbox invoice-archiving purpose. Undeclared secondary integrations expand the trust boundary and may cause the skill to access or transmit data to an unrelated external platform, surprising users and increasing data-exfiltration and secret-handling risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill documentation introduces Feishu credential loading and external integration behavior that is outside the manifest's mailbox invoice-archiving purpose. Undeclared secondary integrations expand the trust boundary and may cause the skill to access or transmit data to an unrelated external platform, surprising users and increasing data-exfiltration and secret-handling risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill documentation introduces Feishu credential loading and external integration behavior that is outside the manifest's mailbox invoice-archiving purpose. Undeclared secondary integrations expand the trust boundary and may cause the skill to access or transmit data to an unrelated external platform, surprising users and increasing data-exfiltration and secret-handling risk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/auth.py (reported line 114)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/auth.py (reported line 119)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 39)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 81)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 125)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 142)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 202)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 203)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/setup_wizard.py (reported line 55)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/setup_wizard.py (reported line 56)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/setup_wizard.py (reported line 67)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/setup_wizard.py (reported line 111)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/system_credentials.py (reported line 41)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/system_credentials.py (reported line 51)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/system_credentials.py (reported line 59)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/system_credentials.py (reported line 76)May include surrounding context.

python

email_address: str | None = None
    mail_provider: str = "auto"
    auth_provider: str = "system"
    keychain_service: str = ""
    auth_secret: str | None = None
    env_email_var: str = "MAIL_INVOICE_ARCHIVER_EMAIL"
    env_secret_var: str = "MAIL_INVOICE_ARCHIVER_AUTH_CODE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This block reads secret from the TOML auth section into runtime configuration, normalizing support for secrets stored in plaintext configuration. In the context of a mailbox-access skill, enabling disk-backed credential loading materially increases the chance of credential theft from local files or synced config directories.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 103)May include surrounding context.

python

if auth_data:
            cfg.email_address = str(auth_data.get("email", cfg.email_address or "")) or cfg.email_address
            cfg.auth_provider = str(auth_data.get("provider", cfg.auth_provider))
            cfg.keychain_service = str(auth_data.get("service", cfg.keychain_service))
            secret = auth_data.get("secret")
            cfg.auth_secret = str(secret) if secret else cfg.auth_secret
            cfg.env_email_var = str(auth_data.get("env_email_var", cfg.env_email_var))

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 115)May include surrounding context.

python

env_account = os.getenv("MAIL_INVOICE_ARCHIVER_EMAIL")
        env_service = os.getenv("MAIL_INVOICE_ARCHIVER_SYSTEM_SERVICE") or os.getenv(
            "MAIL_INVOICE_ARCHIVER_KEYCHAIN_SERVICE"
        )
        env_root = os.getenv("MAIL_INVOICE_ARCHIVER_ARCHIVE_ROOT")
        env_hosts = os.getenv("MAIL_INVOICE_ARCHIVER_HOST_CANDIDATES")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This config-writing section emits both auth metadata and secret = ... into the persisted TOML file, directly storing mailbox credentials in plaintext. Because the skill's purpose is to access mailboxes, compromise of this file would likely grant full mailbox access and expose sensitive invoices and correspondence.

Content

Scanner excerpt · scripts/mail_invoice_archiver/config.py (reported line 188)May include surrounding context.

python

"[auth]",
            "provider = " + _toml_string(config.auth_provider),
            "email = " + _toml_string(config.email_address or ""),
            "service = " + _toml_string(config.keychain_service),
            "env_email_var = " + _toml_string(config.env_email_var),
            "env_secret_var = " + _toml_string(config.env_secret_var),
            "secret = " + _toml_string(config.auth_secret or ""),