Security audit

PixelLetter

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its mail-sending purpose, but it has an undocumented endpoint override that could redirect PixelLetter credentials and documents to an arbitrary server.

Review this skill before installing. Use only in a trusted environment, do not set PIXELLETTER_ENDPOINT unless you have audited the destination, and avoid sharing dry-run output because it may contain private correspondence details even when credentials are redacted. Production sends require explicit flags, but they can still spend account credit and send real mail.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/pixelletter.mjs:6
Finding: Unrestricted API Endpoint Override Enables Credential and Document Exfiltration
Content: View full analysis
${authXml({ email, password, production: Boolean(args.production) })} ${commandXml} `; } ``` ```js async function submit(payload) { const form = new FormData(); form.append('xml', payload.xml); for (let i = 0; i < payload.files.length; i++) { const file = payload.files[i]; const buffer = await readFile(file); form.append(`uploadfile${i}`, new Blob([buffer], { type: 'application/pdf' }), basename(file)); } const response = await fetch(ENDPOINT, { method: 'POST', body: form }); const body = await response.text(); if (!response.ok) throw new Error(`HTTP ${response.status}: ${body.slice(0, 500)}`); return body; } ``` ### Technical Analysis The destination for all API requests can be changed through the undocumented `PIXELLETTER_ENDPOINT` environment variable. The value is passed directly to `fetch()` without validating its protocol, hostname, port, or origin. For non-dry-run operations, the XML payload contains the values of `PIXELLETTER_EMAIL` and `PIXELLETTER_PASSWORD`. Text orders additionally contain recipient addresses and message contents, while upload orders attach complete user-selected documents. Consequently, redirecting the endpoint redirects all of this sensitive data. The implementation also accepts a plain H ...[truncated 1916 chars]
Remediation: View remediation

other

Note

Location: scripts/pixelletter.mjs:178
Finding: Dry-Run Output Exposes Recipient and Correspondence Data
Content: View full analysis
${optionsXml(args, common)} ${xmlEscape(address)} ${xmlEscape(args.subject)} ${xmlEscape(message)} `; return { xml: envelope(command, args), files: [] }; } ``` ```js if (args['dry-run']) { console.log(payload.xml); return; } ``` ### Technical Analysis Dry-run mode replaces the email and password with placeholder values, but it does not redact other sensitive fields. The generated XML still includes the complete recipient address, subject, message, fax number, return address, transaction identifier, and control value. The skill documentation describes dry-run output as “sanitized XML.” That wording can reasonably lead users or agents to assume the complete output is safe to retain or share. In practice, the output is only credential-redacted. Standard output is frequently captured by agent transcripts, CI systems, shell logging, remote execution services, and diagnostic bundles. This issue does not require bypassing access controls. Exploitation depends on an attacker gaining access to logs or transcripts generated by a dry-run, or inducing a user to share output under the mistaken belief that it is ful ...[truncated 1191 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/pixelletter.mjs:6