imap-smtp-email-chinese

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:32 AM UTC
• Version: 1.1.0

Overview

This email skill largely does what it says, but it needs review because attachment downloads, stored email credentials, and optional TLS verification bypass create meaningful account and local-file risks.

Review this before installing. Use a dedicated app password or limited mailbox account, protect or avoid the .env file, do not disable TLS certificate verification except in a controlled test environment, confirm every outbound email and attachment yourself, and avoid downloading attachments until filenames are sanitized and overwrites are prevented.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/imap.js:329

Finding

Email Attachment Filename Allows Path Traversal and Arbitrary File Overwrite

Content

View full analysis

--dir ``` 4. `mailparser` exposes the attacker-provided attachment filename. 5. The Skill joins that filename to `outputDir` without containment validation. 6. `fs.writeFileSync()` writes attacker-controlled attachment data outside the intended directory. 7. If the resolved destination already exists and is writable, it is overwritten. ### Impact Assessment An attacker can ...[truncated 491 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.sh:137

Finding

Setup Stores Reusable Email Credentials in a Plaintext File Without Enforcing Restrictive Permissions

Content

View full analysis

.env << EOF # IMAP Configuration IMAP_HOST=$IMAP_HOST IMAP_PORT=$IMAP_PORT IMAP_USER=$EMAIL IMAP_PASS=$PASSWORD IMAP_TLS=$IMAP_TLS IMAP_REJECT_UNAUTHORIZED=$REJECT_UNAUTHORIZED IMAP_MAILBOX=INBOX # SMTP Configuration SMTP_HOST=$SMTP_HOST SMTP_PORT=$SMTP_PORT SMTP_SECURE=$SMTP_SECURE SMTP_USER=$EMAIL SMTP_PASS=$PASSWORD SMTP_FROM=$EMAIL SMTP_REJECT_UNAUTHORIZED=$REJECT_UNAUTHORIZED EOF ``` ### Technical Analysis The setup script writes the user's password, application password, or authorization code directly into `.env`. It does not set a restrictive `umask`, explicitly assign mode `0600`, or verify the resulting file permissions. The effective permissions therefore depend on the caller's environment. Under a commonly used `umask` of `022`, a newly created file may be readable by other local users. If `.env` already exists, its previous permissions are retained. The project also contains an `.env` file and no `.gitignore` was present in the audited directory, despite documentation recommending that `.env` be ignored. The bundled values appear to be examples and were not established to be active credentials, but shipping the credential filename encourages accidental inclusion of future real secrets in archives or source-control commits. The same reusable credential is written to both `IMAP_PASS` and `SMTP_PASS`, increasing the consequences of disclosure. ### Attack Path 1. A user runs `setup.sh` and enters an email address and reusable password or authorization code. 2. The script writes the credential to `.env` using the caller's ambient file-creation permissions. 3. The file is created with permissive access, inherited unsafe permissions, included in an archive, or accidentally committed to source control. 4. Another local user or a ...[truncated 825 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/smtp.js:29

Finding

Configurable TLS Certificate Verification Bypass Exposes Mail Credentials and Content to Interception

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description claims a broad IMAP/SMTP email skill with both reading and sending capabilities plus mailbox management actions. This code chunk implements only a narrow subset: checking unread messages in INBOX and listing header metadata for up to five messages. It opens the mailbox in read-only mode, so it cannot mark mail as read/unread, and there is no SMTP logic or attachment handling. While checking unread email is consistent with part of the description, the declared purpose substantially overstates the implemented behavior in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code accurately implements most of the declared IMAP-related reading features: checking unread/new mail, fetching message content, searching, listing mailboxes, marking messages read/unread, and handling attachments for downloaded messages. However, it does not contain any SMTP logic or any function to compose/send emails, with or without attachments, which is a material part of the declared purpose. Additionally, the code writes attachments to the local filesystem via a download command, which is not explicitly reflected in the description. The primary mismatch is the missing send-email functionality, so this should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a combined IMAP/SMTP email skill with both inbox-reading and message-sending capabilities. However, this code chunk is exclusively an SMTP CLI sender using nodemailer. Its commands are limited to 'send' and 'test'; there is no IMAP library usage, mailbox access, message retrieval, unread checking, search, or flag manipulation. The sending capability with attachments is consistent with part of the description, but the broader declared functionality is not represented by the provided code chunk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-inbox.js (reported line 4)May include surrounding context.

js

const Imap = require('imap');
const fs = require('fs');

const env = fs.readFileSync('../.env', 'utf8');
const config = {};
env.split('\n').forEach(line => {
  const [key, ...valueParts] = line.split('=');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/imap.js (reported line 13)May include surrounding context.

js

const Imap = require('imap');
const fs = require('fs');

const env = fs.readFileSync('../.env', 'utf8');
const config = {};
env.split('\n').forEach(line => {
  const [key, ...valueParts] = line.split('=');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/smtp.js (reported line 11)May include surrounding context.

js

const Imap = require('imap');
const fs = require('fs');

const env = fs.readFileSync('../.env', 'utf8');
const config = {};
env.split('\n').forEach(line => {
  const [key, ...valueParts] = line.split('=');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/smtp.js (reported line 51)May include surrounding context.

js

const Imap = require('imap');
const fs = require('fs');

const env = fs.readFileSync('../.env', 'utf8');
const config = {};
env.split('\n').forEach(line => {
  const [key, ...valueParts] = line.split('=');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test-conn.js (reported line 4)May include surrounding context.

js

const Imap = require('imap');
const fs = require('fs');

const env = fs.readFileSync('../.env', 'utf8');
const config = {};
env.split('\n').forEach(line => {
  const [key, ...valueParts] = line.split('=');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 9)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 158)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script offers users an easy option to disable certificate verification by setting REJECT_UNAUTHORIZED=false, but does not explain that this defeats TLS server authentication. That enables man-in-the-middle attacks against IMAP/SMTP connections, allowing theft of email credentials and interception or modification of email traffic.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This line begins the heredoc that writes a .env file containing IMAP and SMTP credentials. In the context of an email integration skill, stored credentials can grant full mailbox access and permit sending email as the user, so unauthorized disclosure has significant account and privacy impact.

Content

Scanner excerpt · setup.sh (reported line 136)May include surrounding context.

sh

fi
fi

# Create .env file
cat > .env << EOF
# IMAP Configuration
IMAP_HOST=$IMAP_HOST

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This finding points into the credential-writing block where sensitive configuration is persisted to .env. Although the line itself is a config key, it is part of a block that stores secrets and therefore contributes to credential exposure risk if the file is accessed by unauthorized users or accidentally shared.

Content

Scanner excerpt · setup.sh (reported line 137)May include surrounding context.

sh

fi

# Create .env file
cat > .env << EOF
# IMAP Configuration
IMAP_HOST=$IMAP_HOST
IMAP_PORT=$IMAP_PORT

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to place live IMAP/SMTP credentials in a local .env file and describes broad email read/send capabilities, but it does not clearly warn about the sensitivity of mailbox contents, outbound email abuse, or the need to protect secrets from logs, source control, and unauthorized access. In an email skill, these omissions materially increase the chance of credential exposure or unsafe deployment because compromise enables both data exfiltration from inboxes and impersonation via SMTP.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents access to environment-stored credentials and arbitrary network communication with IMAP/SMTP servers, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because an agent or user may invoke a capability that can read mailbox contents and send mail without clear least-privilege constraints or consent expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill includes an attachment download feature that writes files to the local filesystem but does not prominently warn users about the risks of saving untrusted content locally. This is dangerous because email attachments may contain malware, sensitive data, or unexpected file types, and an agent may download them into unsafe locations without adequate user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill supports sending email and attachments over SMTP but does not include a prominent warning that this may transmit sensitive information externally and can be abused for unauthorized outbound communication. In agent contexts, this is especially risky because a prompt-influenced action could send data, files, or messages to attacker-controlled recipients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The slug imap-smtp-email-chinese explicitly encodes a language constraint ('chinese') in the skill identity, but this manifest provides no indication that users can choose another language or that the locale restriction is justified. For all file types, natural-language policy concerns include forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script loads sensitive configuration values from ../.env, including IMAP credentials later used for mailbox access, but provides no comment, docstring, or user-facing disclosure that it accesses stored secrets. This is a code file, so sensitive credential access should have some visible warning or explanation unless clearly disclosed elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The downloadAttachments flow creates directories and writes attachment contents to local files, which is a safety-relevant file write operation. While the function name implies downloading, this file contains no confirmation prompt and no explicit warning comment/docstring near the write path to disclose that it will modify the local filesystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script stores the email username and password/app password in a plaintext .env file, which can be exposed through weak filesystem permissions, accidental commits, backups, shell history-adjacent workflows, or other local compromise. In an email skill, these credentials provide direct access to inbox contents and outbound mail, making plaintext secret storage materially sensitive.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a caret range instead of an exact pinned version, which makes builds non-reproducible and can silently pull in newly published package versions. In a credential-handling email skill, this increases supply-chain risk because compromised or regressed upstream releases could gain access to IMAP/SMTP credentials or message contents.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"search": "node scripts/imap.js search"
  },
  "dependencies": {
    "dotenv": "^16.6.1",
    "iconv-lite": "^0.7.2",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a floating caret range, so different installs may resolve to different code over time. That creates a supply-chain exposure window where a malicious or vulnerable upstream release could be introduced without any source change in this repository.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

},
  "dependencies": {
    "dotenv": "^16.6.1",
    "iconv-lite": "^0.7.2",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "imapflow": "^1.2.10",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using an unpinned version for an IMAP library is risky because the installed package may change between deployments, affecting code that handles mailbox access and authentication. While not an exploit by itself, it weakens supply-chain integrity and incident reproducibility.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"dependencies": {
    "dotenv": "^16.6.1",
    "iconv-lite": "^0.7.2",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "imapflow": "^1.2.10",
    "mailparser": "^3.9.3",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

A non-exact dependency version permits automatic resolution to newer releases, which can introduce vulnerable or malicious code unexpectedly. Because this skill processes email data, any compromised dependency could expose sensitive messages, attachments, or credentials.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"dotenv": "^16.6.1",
    "iconv-lite": "^0.7.2",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "imapflow": "^1.2.10",
    "mailparser": "^3.9.3",
    "nodemailer": "^7.0.13"

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.potential_exfiltration

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/check-inbox.js:17

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/test-conn.js:19

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/check-inbox.js:4