T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_email.py:56- Finding
SMTP Credentials Persisted in Plaintext Registry and Environment Variables
- Content
View full analysis
- Remediation
View remediation
Security audit
通用 SMTP 邮件发送工具
Security checks for vulnerabilities and agentic risk
Overview
This SMTP email skill is mostly purpose-built, but it needs review because it stores SMTP passwords or app passwords persistently in plaintext and can send arbitrary attachments to arbitrary recipients.
Review before installing. Use only an app-specific, revocable SMTP credential rather than a primary mailbox password, avoid passing passwords on the command line, and avoid the setx/HKCU\Environment storage path if you can use a proper credential manager. Before each send, verify recipients, destination domains, subject/body, and every attachment path because this skill can transmit local files outside your environment.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send_email.py:285- Finding
SMTP Password Accepted Through a Command-Line Argument
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill exposes capabilities involving environment variables and file reading, but the manifest does not declare any explicit tool scope or allowed-tools restrictions. This weakens least-privilege controls and makes it harder for an agent runtime or reviewer to understand and constrain what the skill may access, increasing the chance of unintended credential or file access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases include very broad English terms such as 'notify', 'send email', and 'email report', which can match ordinary user requests and cause the skill to activate unexpectedly. In a skill that can transmit messages and attachments externally, accidental invocation materially raises the risk of unintended data exfiltration or unauthorized outbound communication.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to persist email addresses and passwords or authorization codes in HKCU\Environment via setx or setup flow, but does not provide a strong security warning about the persistence and exposure risks of storing credentials this way. Environment-style storage is often accessible to local processes running as the user and may be disclosed through debugging, logs, process inheritance, or other tooling, making credential compromise more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explains how to send emails and attachments but does not clearly warn that this action can exfiltrate sensitive data to external recipients. Because the skill supports arbitrary recipients, HTML bodies, and attachments, missing safety guidance makes accidental or policy-violating data transfer significantly more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Natural-language strings in the module docstring and throughout the CLI experience are presented only in Chinese, with no option to select another language or locale. This creates a language policy issue because the skill effectively requires one language without documenting a justified regional constraint or offering user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script stores SMTP credentials persistently in HKCU\Environment as plaintext REG_SZ values, which is not a secure secret store. Any process or user context able to read that registry location or inherited environment configuration can recover the mailbox password/app password, enabling unauthorized email sending and possible account compromise.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The top-level docstring describes configuration as occurring 'through environment variables or registry' and says the script can guide setup, which suggests either mechanism may be used. In practice, the guided setup path always writes the address and password into the Windows registry under HKCU\Environment and only mirrors them into the current process environment, so the documentation understates the persistence side effect of setup.
- Content