Mailbutler

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed inbox-triage playbook that handles sensitive email data, but its access, approvals, and local storage are coherent with that purpose.

Install only if you are comfortable letting an approved mailbox adapter and model process email for the accounts and time windows you request. Review or delete ~/.mailbutler/narrative.md as sensitive local state, keep draft/send approvals per message, and prefer a pinned or verified install command instead of running mutable npx instructions with elevated privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:50

Finding

Unpinned Package Execution in the Recommended Installation Command

Content

View full analysis

Vulnerability Details

File Location: README.md:50
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx skills add AntreasAntoniou/mailbutler-agent-skill

Technical Analysis

The documented installation command invokes npx without specifying an audited version of the skills package. Depending on the local environment and cache state, npx may retrieve the current package release from the configured npm registry and execute its code with the privileges of the installing user.

Because the package version and integrity are not pinned, the code executed by this instruction can change after the Skill itself has been reviewed. A compromised package publisher, npm account, registry, or newly published malicious version could therefore turn the documented installation process into a supply-chain execution channel.

The target Skill reference is also not pinned to a release or commit in the command, reducing installation reproducibility and making it harder for users to verify that the installed content matches an audited revision.

Attack Path

1. An attacker compromises the npm package, its publisher account, or another component of the package distribution path used for skills.
2. The attacker publishes a malicious version under the package name resolved by npx.
3. A user follows the installation command from README.md.
4. npx retrieves the mutable package version from the configured registry.
5. The package executes malicious installation logic with the current user's privileges.
6. The malicious code may access files and credentials available to that user, alter the installed Skill, or execute additional local commands.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running the installation command. The accessible scope would include files, environment variables, ...[truncated 485 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer package to a specific audited version, for example by using an explicit skills@<version> reference supported by the installation tooling.
2. Publish and verify the expected package integrity hash or signed provenance before execution.
3. Pin the Skill source to a signed release tag or immutable commit rather than relying on a mutable repository reference.
4. Document the expected npm package publisher, registry, version, and verification procedure so users can detect package substitution.
5. Offer a manual installation method that downloads a fixed release archive, verifies its checksum or signature, and installs it without executing an unreviewed package.
6. Advise users not to run the installation command with administrator or root privileges.
7. Add automated release checks ensuring the documented installer and Skill revision remain pinned and reproducible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 3)May include surrounding context.

md

# Security policy

Please report vulnerabilities privately through GitHub Security Advisories for this repository. Do not open a public issue containing mailbox contents, account identifiers, access tokens, draft identifiers, message identifiers, or real recipient addresses.

The skill is an operational playbook, not a sandbox. Its guarantees depend on the host agent respecting the approval states and on the configured mailbox adapter enforcing its own authorization model.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code chunk does not implement or support inbox triage behavior. Its primary purpose is unrelated test automation for package contents and text hygiene. It reads local repository files, not mail through a mailbox adapter, and performs compliance/assertion checks rather than surfacing important messages or recommending read/reply actions. This is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/security-contract.md (reported line 32)May include surrounding context.

md

## Provider boundary

Mailbox contents may be processed only through services the owner has already approved. If the configured agent runtime uses a remote model, disclose that fact according to the runtime's policy. Do not silently forward messages to another model, logging service, analytics tool, or hosted database.

## Local state

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of shell commands, file reads, and file writes, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, missing capability declarations weakens policy enforcement and can let the skill run with broader ambient privileges than intended, especially when handling sensitive mailbox data and local persistence.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill persists a local narrative derived from private email into ~/.mailbutler/narrative.md, creating durable sensitive state on disk. Even with restrictive file modes, persistent storage increases exposure to local compromise, cross-session data leakage, stale inaccurate profiling, and over-collection of personal information beyond what is necessary for a single triage session.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

### 2. Load the local narrative

Read `~/.mailbutler/narrative.md` when present. Create `~/.mailbutler/` with mode `0700` and the file with mode `0600` before first persistence. Treat both as sensitive local state.

Use these sections:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_judgment_tools.py (reported line 57)May include surrounding context.

python

with tempfile.TemporaryDirectory() as directory:
            path = Path(directory) / "judgments.json"
            path.write_text(json.dumps([judgment(action="see")]), encoding="utf-8")
            result = subprocess.run([sys.executable, str(MODULE_PATH), str(path)], text=True, capture_output=True, check=False)
        self.assertEqual(result.returncode, 0)
        self.assertEqual(result.stdout.strip(), "1 email worth your time — 0 handled quietly.")

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_judgment_tools.py:15