Email Send Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.0.2

Overview

This email-sending skill appears purpose-aligned, but it has review-worthy risks around SMTP credential handling, broad outbound sending, and a vulnerable Nodemailer dependency.

Review before installing. Use a dedicated SMTP app password with minimal permissions, inject it through a secret manager or inherited environment rather than inline command text, require explicit confirmation before sending, and update Nodemailer to a patched supported version before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:53

Finding

SMTP Credential Exposure Through Agent-Generated Command Text

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53–63 and line 73
Vulnerability Type: Sensitive credential exposure through command construction
Risk Level: Medium

Vulnerable Code Snippet:

bash

SMTP_HOST=smtp.163.com \
SMTP_PORT=465 \
SMTP_SECURE=true \
SMTP_USER=[e-mail] \
SMTP_PASS=your-smtp-password \
SMTP_FROM="Your Name <[e-mail]>" \
node {baseDir}/scripts/send.js \
  --to "[e-mail]" \
  --subject "Email Subject" \
  --body "Email Body"

text

When the user requests sending an email, use the exec tool to execute the command above.

Technical Analysis

The Skill directs the AI Agent to execute a shell command containing the SMTP password as an inline environment-variable assignment. When the placeholder is replaced with a real credential, the secret becomes part of the generated command text.

Although an inline assignment may not be retained in ordinary interactive shell history in every execution environment, the complete command can still be exposed through Agent conversation records, tool-call transcripts, executor logs, audit telemetry, debugging output, or process inspection. This behavior also conflicts with the Skill's own warning against placing real SMTP credentials directly on the command line.

The executable script itself reads SMTP_PASS from the environment and does not print it. The vulnerability is therefore in the documented Agent invocation procedure rather than in scripts/send.js.

Attack Path

1. A user or operator configures the Skill with a real SMTP account and password.
2. The Agent follows SKILL.md and constructs an exec command containing SMTP_PASS=<real-secret>.
3. The Agent platform, execution service, telemetry system, or another monitoring component records the complete tool call or command.
4. An attacker with access to those records extracts the SMTP username, host, a ...[truncated 740 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove SMTP_PASS and other credentials from all generated command strings and examples intended for direct Agent execution.

2. Provision SMTP credentials through the executor's inherited environment, a platform secret manager, or a dedicated credential-injection mechanism.

3. Instruct the Agent to invoke only the script and non-secret arguments, for example:

   bash

   node {baseDir}/scripts/send.js \
     --to "[e-mail]" \
     --subject "Email Subject" \
     --body "Email Body"
   

4. Configure the Agent platform and execution layer to redact known secret values and sensitive environment-variable names from tool-call records, logs, traces, and error reports.

5. Use a dedicated SMTP authorization token with the minimum necessary permissions instead of the mailbox's primary password.

6. Rotate any credential that may already have appeared in Agent transcripts or executor logs.

7. Restrict access to historical tool logs and define a short retention period for records that may contain sensitive command data.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Known Vulnerable Dependency: nodemailer==6.10.1 — 12 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +9 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lockfile pins nodemailer to 6.10.1, and the finding cites multiple published advisories affecting that version, including header injection, denial of service, and bypass-related issues. In the context of an email-sending skill that accepts user-driven mail content and addresses, these flaws are especially relevant because attacker-controlled email fields may directly reach the vulnerable library paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==6.10.1 — 12 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +9 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The static finding indicates resolution to nodemailer 6.10.1, a version with multiple published advisories including header injection, denial-of-service, and file/content access control bypass issues. In this skill's context, which accepts user-driven email content and sends mail to arbitrary recipients, such flaws are especially dangerous because attacker-controlled fields may flow directly into message construction and SMTP handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requires sensitive environment variables, including SMTP credentials, and instructs the agent to use execution, but it does not declare explicit tool scope such as allowed-tools or permissions. In an agent environment, this weakens control boundaries and can let the skill access execution and secrets more broadly than is obvious to reviewers, increasing the chance of credential misuse or unintended command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger condition says the skill should run whenever a user requests sending email, which is very broad and lacks guardrails such as confirmation requirements, recipient restrictions, or abuse checks. In practice, this can enable phishing, spam, exfiltration of generated content, or accidental dispatch of sensitive information because ordinary natural-language requests may activate outbound email behavior too easily.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language description is entirely in Chinese and does not indicate that the skill supports multiple languages or that Chinese is a required locale for a region-specific use case. Under the language/locale policy, this can be a policy violation when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains its docstring, usage instructions, and error/output messages entirely in Chinese. The policy explicitly flags language or locale constraints when a skill forces a specific language without user opt-in, and there is no indication here that the skill is region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a caret range (^6.9.0), which permits automatic installation of newer minor and patch releases rather than a single vetted version. In a security-sensitive skill that sends arbitrary email via SMTP, this weakens supply-chain control and can unexpectedly pull in vulnerable or behavior-changing versions, increasing operational and security risk.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"author": "",
  "license": "ISC",
  "dependencies": {
    "nodemailer": "^6.9.0"
  }
}