ClawHub
Back to skill

Security audit

email-triage

Security checks across malware telemetry and agentic risk

Overview

This email triage skill appears purpose-built, but it handles private mailbox data in ways that deserve review before installation.

Install only if you are comfortable giving the skill IMAP credentials and letting it process private email metadata and previews. Keep OLLAMA_URL pointed at a local trusted Ollama server unless you intentionally want email-derived content sent elsewhere, and treat the local state file as sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'req' from os.environ.get (line 189, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
data=payload,
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=CLASSIFICATION_TIMEOUT) as resp:
            result = json.loads(resp.read())
            response_text = result.get("response", "").strip()
Confidence
94% confidence
Finding
with urllib.request.urlopen(req, timeout=CLASSIFICATION_TIMEOUT) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documentation describes capabilities to read credentials from environment variables, connect to external IMAP servers, optional local Ollama HTTP endpoints, and write persistent state to disk, but it does not declare corresponding permissions. Even if the behavior is expected for an email-triage skill, the missing permission declaration weakens transparency and policy enforcement, making it easier for an agent runner to grant broader access than users realize.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill transmits email-derived content to the Ollama API during classification, but there is no explicit runtime consent or warning at the moment data leaves the inbox. Even though the description mentions Ollama, users may not realize sender/subject/body preview are being sent over HTTP, creating a privacy and data-handling risk for potentially sensitive messages.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The tool persistently stores subject, sender, date, category, reason, and a body preview in a local JSON state file without an explicit warning that email content will be retained on disk. This can expose sensitive metadata and message excerpts to other local users, backups, or later compromise, especially because previews may contain confidential content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.