Security audit

drin-agent-inbox

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Drin email-inbox skill, but users should add their own sender authorization and approval controls before letting email trigger actions beyond replies.

Install this only for agents that are meant to operate an email inbox. Treat all email bodies, headers, links, and attachments as untrusted input; verify webhooks, authorize senders separately, limit what other tools the agent can use, and require human approval for sensitive, destructive, financial, administrative, or privacy-impacting actions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:47
Finding: Untrusted Inbound Email Content Can Influence Agent Tool Actions
Content: View full analysis
", text: "...", html: "..." }` (or `POST /v1/emails/:id/reply`). Drin sets `In-Reply-To`/`References` and the `Re:` subject automatically; `from` defaults to the inbox address and `to` to the original sender. ``` The unsafe data flow is also demonstrated in the minimal agent loop at lines 79–86: ```text for thread in list_threads(inboxId): convo = get_thread(thread.id) for msg in convo.messages where msg.direction == "inbound" and msg.id not in seen: body = get_email_body(msg.id) action = decide(convo, body) # your agent's reasoning reply_email(messageId=msg.id, text=action.reply, idempotencyKey=msg.id) seen.add(msg.id) save_processed_ids(seen) ``` ### Technical Analysis The Skill instructs an autonomous agent to read inbound message bodies and attachments, pass that content into its decision process, and potentially “take an action with other tools.” Email bodies, headers, and attachments are attacker-controlled inputs. The documented workflow does not require a trust boundary between email content and agent instructions, an authorization check for the sender, an action allowlist, or human approval before sensitive operations. An attacker can therefore place prompt-injection instructions in an email or attachment. If the agent interprets those instructions as operational directions rather than untrusted data, it may invoke tools or formulate replies contrary to the operator's intent. The fina ...[truncated 1810 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep