Mailbutler

• Outcome: Review
• Latest audit: Sep 5, 2026 · 4:25 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed email-triage workflow with sensitive but purpose-aligned mailbox access and local narrative storage.

Before installing, confirm you trust the mailbox adapter and model provider, start with a narrow account and recent time window, and remember that ~/.mailbutler/narrative.md may contain condensed sensitive context from your email. Prefer installing from a pinned reviewed commit or release rather than an unqualified npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:50
• Finding: Unpinned Remote Installation Command Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `README.md:50` **Vulnerability Type**: Unpinned third-party installer and mutable remote source **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npx skills add AntreasAntoniou/mailbutler-agent-skill ``` ### Technical Analysis The documented installation command invokes the `skills` package through `npx` without specifying an exact package version. It also identifies the Skill repository without pinning an immutable commit or verifying its integrity through a checksum or cryptographic signature. Consequently, the software executed or installed by this command can differ from the content reviewed during this audit. The effective installation path depends on mutable third-party distribution infrastructure, package ownership, repository state, and name resolution at the time the command is run. This is a supply-chain weakness rather than evidence that the currently audited source is malicious. The reviewed Python helper does not itself retrieve or execute remote payloads. ### Attack Path 1. An attacker compromises the npm package or account that resolves the unversioned `skills` command, or compromises the referenced upstream repository or maintainer account. 2. The attacker publishes a malicious package version or modifies the repository content resolved by the installer. 3. A user follows the documented installation command. 4. `npx` retrieves and executes the currently resolved installer rather than a version whose exact contents were audited. 5. The compromised installer executes with the invoking user's privileges or installs altered Skill instructions and scripts. 6. The malicious component can access resources available to that user or later influence the agent when the installed Skill is loaded. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges of the user running `npx`, subject to the behavior and permissions of the compromised installer. Po ...[truncated 442 chars]
• Remediation: ## Remediation Suggestions 1. Pin the `skills` CLI to an exact reviewed version: ```bash npx --yes skills@<exact-version> add AntreasAntoniou/mailbutler-agent-skill@<immutable-reference> ``` 2. Pin the Skill source to an immutable commit hash rather than a mutable branch or unqualified repository reference. 3. Publish and document a cryptographic checksum or signed release artifact, and require verification before installation. 4. Document the expected package publisher, repository URL, release tag, and commit hash so users can verify provenance. 5. Prefer a lockfile-backed or otherwise reproducible installation process where supported. 6. Use npm provenance/signature verification and a trusted registry configuration where available. 7. In security-sensitive environments, download and inspect the pinned source first, then install it without allowing an unreviewed remote package to execute automatically.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

### 2. Load the local narrative

Read `~/.mailbutler/narrative.md` when present. Create `~/.mailbutler/` with mode `0700` and the file with mode `0600` before first persistence. Treat both as sensitive local state.

Use these sections:

• Confidence: 70% confidence
• Finding: The skill persists a sensitivity-rich local narrative derived from mailbox contents, including active projects, relationships, open loops, and durable facts. Even with restrictive file modes, this creates a privacy and data-retention risk: compromise of the local account, backups, logs, or downstream tooling could expose a condensed intelligence file that is easier to exploit than raw email.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_judgment_tools.py:15