Email

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:04 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward SMTP email sender, but it can send workspace files and sensitive text externally with weak guardrails and insecure credential/transport options.

Review carefully before installing. Use a dedicated low-privilege sending account, prefer environment variables or a secret manager over a workspace config file, keep TLS/SSL enabled, and require manual review of recipients, body text, and attachments before any email is sent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: email_sender.py:137

Finding

SMTP Credentials and Message Content Can Be Transmitted Without Encryption

Content

View full analysis

Vulnerability Details

File Location: email_sender.py, lines 137-155
Vulnerability Type: Optional plaintext SMTP authentication and transmission
Risk Level: High

Vulnerable Code

python

# Connect to SMTP server
context = ssl.create_default_context()

if self.config.get('use_ssl', False):
    # SSL connection
    server = smtplib.SMTP_SSL(
        self.config['smtp_server'],
        self.config['smtp_port'],
        context=context
    )
else:
    # TLS connection (default)
    server = smtplib.SMTP(
        self.config['smtp_server'],
        self.config['smtp_port']
    )
    if self.config.get('use_tls', True):
        server.starttls(context=context)

# Login and send
server.login(self.config['username'], self.config['password'])
server.send_message(msg, from_addr=self.config['username'], to_addrs=all_recipients)

Technical Analysis

The application permits both use_ssl and use_tls to be disabled. When this occurs, it creates a plaintext SMTP connection and proceeds to call server.login() without first establishing an encrypted transport.

Depending on the authentication mechanisms supported by the SMTP server, the username and password may be transmitted in a trivially decodable form. Message headers, recipient addresses, body content, and attachments are also exposed to interception or modification.

Although TLS is enabled by default, secure transport is not enforced. An unsafe configuration, such as EMAIL_USE_TLS=false with EMAIL_USE_SSL=false, is sufficient to activate the vulnerable path. The code does not reject this configuration or verify that encryption is active before authenticating.

Attack Path

1. The Skill is deployed with use_ssl and use_tls disabled, whether through an explicit environment setting, an integration error, or an unsafe custom SMTP configuration.
2. The Skill creates a standard plaintext smtplib.SMTP connection.

...[truncated 1149 chars]

Remediation

View remediation

Remediation Suggestions

• Reject configurations in which both use_ssl and use_tls are disabled.
• Make encrypted transport mandatory before calling login() or transmitting a message.
• Prefer implicit TLS through SMTP_SSL on an appropriate port or mandatory STARTTLS with a default certificate-verifying SSL context.
• After calling starttls(), issue ehlo() again and ensure the operation completed successfully before authentication.
• Fail closed if the SMTP server does not advertise STARTTLS or if certificate validation fails.
• Consider replacing the two booleans with a single validated transport mode, such as implicit_tls or starttls, to prevent contradictory settings.
• Add tests confirming that plaintext authentication is impossible under every configuration combination.
• Document that disabling certificate verification or encrypted transport is unsupported.

Example validation:

python

use_ssl = self.config.get('use_ssl', False)
use_tls = self.config.get('use_tls', True)

if not use_ssl and not use_tls:
    raise ValueError("Encrypted SMTP transport is required")

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

SMTP App Passwords Are Directed into Plaintext Workspace Configuration Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-35; duplicated in README.md, lines 36-47
Vulnerability Type: Insecure storage guidance for authentication secrets
Risk Level: Medium

Vulnerable Documentation

markdown

Create a configuration file `email_config.json` in your workspace:

```json
{
  "smtp_server": "smtp.gmail.com",
  "smtp_port": 587,
  "username": "[e-mail]",
  "password": "your-app-password",
  "sender_name": "OpenClaw Assistant",
  "use_tls": true,
  "use_ssl": false
}

text

### Technical Analysis

The primary setup instructions direct users to place an SMTP app password in a plaintext JSON file located in the workspace. The project does not include a `.gitignore` entry protecting `email_config.json`, and the setup procedure does not require restrictive filesystem permissions.

The documentation later warns users not to commit credentials and mentions environment variables as an alternative, but these warnings do not protect the primary documented configuration method. Workspace files are commonly included in source-control commits, archives, automated backups, synchronization systems, debugging bundles, or agent-readable contexts.

The application reads the secret directly from the JSON file and provides no integration with an operating-system credential store or external secret manager. It also does not validate file ownership or permissions before loading credentials.

### Attack Path

1. A user follows the primary setup instructions and creates `email_config.json` in the project or OpenClaw workspace.
2. The user writes a valid SMTP username and app password into the plaintext file.
3. The file is exposed through an accidental source-control commit, workspace sharing, backup, synchronization service, overly broad filesystem permissions, or another local process with workspace access.
4. An attacker retrieves the credential from the JSON file
...[truncated 752 chars]

Remediation

View remediation

Remediation Suggestions

• Make a secret manager, operating-system credential store, or injected environment variable the primary configuration mechanism.
• Remove the password field from the recommended workspace JSON configuration. If file storage must remain supported, place secrets in a separate file outside the workspace.
• Add email_config.json and other local secret-file patterns to a project .gitignore.
• Require owner-only file permissions on POSIX systems, such as mode 0600, and reject or warn about group/world-readable files.
• Document equivalent restrictive access-control requirements for Windows.
• Avoid including configuration files in diagnostic archives, logs, backups, or agent prompts.
• Recommend narrowly scoped app passwords belonging to a dedicated automation mailbox.
• Add secret-scanning checks to continuous integration and provide credential-revocation instructions for accidental disclosure.
• Ensure exceptions and debug output never serialize or print the loaded configuration dictionary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is described as handling broad email management tasks like reading, searching, and organizing mail, but the documented functionality is limited to SMTP sending. This mismatch can mislead users and orchestrators into granting trust or invoking the skill for broader mailbox operations, increasing the risk of unsafe assumptions and accidental data disclosure through unintended use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README encourages natural-language email sending and file attachment workflows but does not clearly warn users that prompts may cause transmission of sensitive content to external recipients. In an AI/automation context, this increases the risk of unintended disclosure of private data, misaddressed emails, or exfiltration of local files when users invoke high-level commands without explicit confirmation or privacy guidance.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents behavior that relies on reading environment variables and a local configuration file, but it does not declare any explicit tool scope or permissions. In an agent ecosystem, missing scope declarations weaken the trust boundary, making it easier for the skill to access local secrets or files without clear user/admin review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description and feature list do not prominently warn users that message bodies, recipients, and attachments will be transmitted to third-party mail providers. Because this skill’s core function is external data transmission, the lack of an upfront disclosure increases the chance that users will unknowingly send sensitive workspace data outside the local environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation examples are broad natural-language commands such as sending reports or notes by email, without requiring confirmation, recipient validation, or exclusion conditions. In an agent setting, this can trigger transmission of sensitive content or attachments to external recipients based on ambiguous user phrasing, making unintended exfiltration materially more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code connects to an SMTP server, authenticates, and sends message content plus any attachments to external recipients. While the docstring states that the function sends email, there is no user-facing confirmation, warning, or disclosure at send time about transmitting potentially sensitive body text or attached files off-system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The integration examples show how to send emails and attach files, but they do not prominently warn that message bodies and attachments will be transmitted to external systems. In an agentic workflow, this missing disclosure can cause users to invoke the skill without realizing they are exporting potentially sensitive workspace data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example custom commands are broad natural-language triggers such as 'send email to

' and 'email to ', which can easily overlap with normal user requests. In an agent environment, that increases the chance of unintended invocation and unreviewed exfiltration of message content or local files to external recipients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The value "OpenClaw Assistant" is a natural-language string fixed in English. Because this file does not indicate that the sender name is configurable for user locale or language preference, it may impose a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill accesses EMAIL_USERNAME and EMAIL_PASSWORD from the environment to authenticate with SMTP. Although this is common, the file provides no warning or user-facing notice that sensitive credentials will be consumed from environment variables.

Content

No source excerpt is available for this finding.