Security audit

Zoho Email Integration

Security checks across malware telemetry and agentic risk

Overview

The skill is a real Zoho Mail automation tool, but it has high-impact mailbox and local-file powers with some under-scoped safety controls that deserve review before installation.

Install only if you trust the publisher and need full mailbox automation. Use a dedicated Zoho account or narrowly scoped OAuth app where possible, protect token files, avoid exposing /email commands in public chat channels, download attachments only into a quarantine directory, and use dry-run/confirmation workflows before any bulk delete or move operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill metadata declares runtime requirements and a token file but does not declare permissions despite documented capabilities for environment access, filesystem reads/writes, shell execution, and network communication. This creates a transparency and review gap: users and platforms may grant or trust the skill without understanding that it can access secrets, write files, and invoke external commands.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The document and skill metadata assert the integration is hardened against path traversal, but this audit summary does not document any path-traversal analysis or mitigation. That creates a misleading security claim that could cause operators to trust file-handling behavior that has not actually been verified, increasing the chance of unsafe deployment or missed review of attachment/file path handling.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document prominently claims OAuth2 support and references a token file, but the actual setup and usage instructions shown to users rely on app-password and environment-variable authentication. This mismatch can cause users to believe they are using stronger token-based auth when they may instead deploy static credentials, increasing exposure from credential leakage or reuse.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script exposes destructive mailbox operations including delete, move, bulk-action delete, and convenience commands to empty Spam and Trash. In an agent skill context, these capabilities materially expand impact from read/send automation to irreversible mailbox modification, increasing the blast radius if the tool is invoked accidentally, by prompt injection, or by a compromised agent workflow.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The attachment download path is only sanitized when no output_path is supplied; if output_path is provided, it is written directly to disk. In an agent environment, an attacker controlling arguments can cause arbitrary file write to user-accessible paths, potentially overwriting config, shell startup files, or other sensitive files.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The script builds shell command strings and executes them with bash -c, while claiming there is no injection risk based only on validation of TEST_RECIPIENT. However, the constructed commands also include dynamic shell expansions like $(date) and rely on string-based command execution, which is a dangerous pattern because future changes or less-trusted inputs could turn this into command injection; additionally, echoing the full command may expose sensitive operational details.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The attachment download feature writes email-derived content to the local filesystem, but the documentation does not prominently warn about the risks of writing untrusted files or of using sender-controlled filenames. In an email integration skill, attachments are inherently attacker-influenced, so silent local writes can lead to overwrites, unsafe file placement, or later execution by a user or downstream automation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The automated workflow encourages bulk downloading attachments selected from email content without emphasizing that this performs multiple local file writes based on untrusted input. In context, this is more dangerous because the skill is meant for automation workflows, so malicious emails could trigger mass writes of harmful or deceptive files that later get processed by other tools.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation instructs users to export or source email credentials and token file paths without any warning about secret handling, file permissions, shell history, or multi-user environments. In automation contexts, this can lead to credential exposure through readable credential files, inherited environment variables, logs, or accidental disclosure during debugging.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The examples forward email-derived status and potentially search-derived content into Telegram/Discord channels without warning about privacy, sensitivity, or destination trust. If users adapt these patterns to include subject lines, sender names, or message excerpts, they may unintentionally exfiltrate sensitive email data to third-party chat platforms or broadly visible channels.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script sources a local credentials file directly into the shell environment, which means anyone who can modify that file or influence its contents can execute arbitrary shell commands when the script runs. Because the script is intended for cron use, this can turn a credential-loading step into persistent code execution and also risks exposing sensitive OAuth material through insecure local storage practices.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script unconditionally rewrites `zoho-email.py` in place without prompting, backup creation, atomic write, or validation that the replacements succeeded as intended. While this is not a classic security exploit by itself, it is a real unsafe file-modification behavior that can corrupt the target file, destroy local changes, or be abused in automation to silently alter executable code.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The test script performs a real outbound email send to a hard-coded address as part of routine verification, with only a generic test subject and no explicit guardrail such as a dry-run mode, confirmation, or environment gating. In an agent skill context, this is dangerous because automated or repeated execution can cause unintended external communication, leak operational metadata, and trigger spam or compliance issues.

Credential Access

High

Category: Privilege Escalation
Content: ### Security - **Permissions:** 600 (owner read/write only) - **Contents:** Client ID, Client Secret, Access Token, Refresh Token - **Encryption:** Not encrypted (store in secure location) - **Version control:** Add to `.gitignore`
Confidence: 80% confidence
Finding: Access Token

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Zoho Email Integration - Python Requirements # REST API support (v2.0.0+) requests>=2.31.0 # OAuth2 uses Python standard library for IMAP/SMTP mode # REST API mode requires requests library for HTTP operations
Confidence: 93% confidence
Finding: requests>=2.31.0

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

Category: Supply Chain
Confidence: 89% confidence
Finding: requests==2.31.0

VirusTotal

VirusTotal findings are pending for this skill version.