ClawHub
Back to skill

Security audit

Assistant Mail

Security checks across malware telemetry and agentic risk

Overview

The skill is not malicious, but it should be reviewed because its short description says email sending while the documented MCP tools also read, modify, and delete mailbox data.

Install only if you intend to give an agent broad AssistantMail mailbox authority, not just email sending. Use a least-privilege API key where possible, avoid sharing production mailbox credentials unnecessarily, and require human approval for sending emails, changing policies, managing recipients, or deleting mailboxes/messages.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest advertises a narrow email-sending skill, but the documented tools expose significantly broader capabilities including mailbox listing, message retrieval, policy changes, recipient management, and deletion. This mismatch can cause operators or downstream agents to grant or invoke the skill under false assumptions, increasing the risk of unauthorized access, destructive actions, or privacy-impacting data handling.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The Capability section states that agents can discover endpoint details and directly fetch mailbox and message data, which contradicts the narrower 'send emails' description in the manifest. Such contradictory documentation weakens informed consent and safe deployment because users may not realize the skill has read access to mailbox contents and metadata.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill exposes tools for sending email, reading messages, updating policies, and deleting mailboxes or messages without an explicit warning about privacy, data loss, or external side effects. In an agent context, these actions can directly affect real users and communications, so missing warnings and guardrails raise the chance of unsafe autonomous use.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.