ClawHub
Back to skill

Security audit

assistant-mail

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed email integration, but it asks users to run an unverified third-party MCP with an API key and broad mailbox read, send, update, and delete authority.

Review this before installing if you will connect real mailboxes. Use a narrowly scoped, revocable API key if available, keep ASSISTANT_MAIL_API_BASE_URL at the default hosted endpoint unless you deliberately trust another endpoint, avoid broad mailbox/delete permissions where possible, and confirm package provenance/version before running assistantmail-mcp.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:81
Finding

Unpinned Third-Party Skill Executes an Unverifiable MCP Component

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 81-83; related executable declaration at lines 56-58
Vulnerability Type: Supply-chain exposure through an unpinned external package
Risk Level: Medium

Vulnerable code snippet:

markdown
## OpenClaw
Install from ClawHub, then register the MCP command `assistantmail-mcp` and set `ASSISTANT_MAIL_API_KEY`:

```bash
openclaw skills install @assistantmail/assistant-mail
text

The executable invoked by the installed package is declared separately:

```markdown
## MCP Connection
- **Command**: `assistantmail-mcp`

Technical Analysis

The installation command identifies a third-party package by name without pinning an immutable version, integrity digest, or verified signature. The resulting assistantmail-mcp executable is expected to run with access to ASSISTANT_MAIL_API_KEY and email-related data.

The audited artifact contains only SKILL.md; it does not contain the MCP implementation, a dependency lockfile, a package digest, or reproducible build information. Consequently, the behavior and provenance of the executable cannot be independently verified from this project. A later package release or compromised distribution account could replace the reviewed behavior while retaining the same package and executable names.

Attack Path

  1. An attacker compromises the third-party package publisher, distribution account, or release pipeline.
  2. The attacker publishes a modified package under the existing @assistantmail/assistant-mail name.
  3. A user follows the unpinned installation instruction and receives the attacker-controlled release.
  4. The agent runtime launches assistantmail-mcp and supplies ASSISTANT_MAIL_API_KEY through its environment.
  5. The modified executable reads or exfiltrates the API key, mailbox identifiers, message contents, recipients, or tool arguments.
  6. The attacker uses the stolen credentials to p ...[truncated 687 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the installed Skill to a specific, audited, immutable version rather than using only the package name.
  • Publish and verify a cryptographic checksum or package signature before execution.
  • Document the exact source repository, package registry, release identifier, and provenance of assistantmail-mcp.
  • Provide reproducible build instructions and committed dependency lock data so the executable can be independently audited.
  • Run the MCP process in a restricted environment with only the required network access and filesystem permissions.
  • Use short-lived, revocable API credentials scoped to the minimum required mailbox and operations.
  • Establish package-release monitoring and revoke affected credentials immediately if package integrity is compromised.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:56
Finding

Configurable API Destination May Receive Automatically Sourced Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56-62; related credential behavior at lines 174-180
Vulnerability Type: Unsafe combination of a configurable network destination and implicit secret use
Risk Level: Medium

Vulnerable code snippet:

markdown
## MCP Connection
- **Command**: `assistantmail-mcp`
- **Environment**:
  - `ASSISTANT_MAIL_API_BASE_URL` (optional, defaults to `https://api.assistant-mail.ai`)
  - `ASSISTANT_MAIL_API_KEY` (optional, `amk_...`; used by direct tools when `apiKey` input is omitted)
- **Available tools**:

The implicit credential behavior is reiterated later:

markdown
If `ASSISTANT_MAIL_API_KEY` is set in the MCP server environment, you can omit `apiKey` in tool input.

Technical Analysis

The documented configuration permits the API base URL to be overridden while allowing tools to source the API key automatically from the MCP process environment. This creates a credential-forwarding risk: if an attacker or an untrusted configuration source changes ASSISTANT_MAIL_API_BASE_URL, subsequent tool calls may authenticate to the altered destination using the environment-provided secret.

Sending API credentials and message content to the legitimate hosted email service is necessary for the declared functionality. The security issue is that the destination is configurable without any documented HTTPS-only validation, hostname allowlist, explicit confirmation before credential forwarding, or cross-origin redirect protection.

Because the MCP implementation is absent from the artifact, the audit cannot verify whether such controls exist at runtime. The documentation itself does not require them and encourages implicit credential use.

Attack Path

  1. An attacker gains the ability to modify the MCP server configuration, deployment environment, or generated connector settings.
  2. The attacker sets ASSISTANT_MAIL_API_BASE_URL to an attacker-co ...[truncated 1405 chars]
Remediation
View remediation

Remediation Suggestions

  • Default to a fixed https://api.assistant-mail.ai origin and reject arbitrary destination overrides in production.
  • If custom endpoints are required, enforce an explicit HTTPS hostname allowlist and reject embedded credentials, insecure schemes, malformed hosts, and unexpected ports.
  • Require explicit operator confirmation before forwarding an API key to any non-default origin.
  • Never forward authorization headers across cross-origin redirects; preferably disable redirects for authenticated API requests.
  • Keep environment-sourced credentials disabled when a custom base URL is configured unless the destination has been separately trusted.
  • Use narrowly scoped, short-lived, independently revocable API keys rather than an account-wide credential.
  • Avoid placing API keys directly in per-call tool arguments, where they may be retained in agent transcripts or logs.
  • Redact authorization headers, API keys, message bodies, and recipient data from logs and error telemetry.
  • Document and test destination validation, TLS certificate verification, redirect handling, and credential-scoping behavior in the MCP implementation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.