Security audit
Security checks for vulnerabilities and agentic risk
This Zoho Mail skill mostly does what it claims, but it handles powerful mailbox tokens in ways that need review before installation.
Review this before installing on any account with sensitive mail. Use a dedicated Zoho OAuth client with the minimum needed scopes, do not set ZOHO_API_BASE_URL or mail server overrides to untrusted hosts, keep token files out of shared directories and CI logs, restrict /email bot commands to trusted users, and use dry-run before bulk delete or cleanup actions. Revoke the Zoho connected app if the token file may have been exposed.
scripts/zoho-email.py:153OAuth Bearer Token Disclosure Through an Unrestricted API Endpoint Override
scripts/oauth-setup.py:41OAuth Authorization Callback Lacks CSRF State Validation
scripts/oauth-setup.py:149OAuth Token Files Are Written Before Restrictive Permissions Are Applied
test-app-password.sh:44App-Password Test Script Prints a Live Password Prefix
requirements.txt:4Third-Party Dependency Is Not Reproducibly Pinned
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
#### Technical Details
- Endpoint changed from `PUT /accounts/{id}/messages/{id}` to `PUT /accounts/{id}/updatemessage`
- Delete endpoint now uses `DELETE /accounts/{id}/folders/{folderId}/messages/{id}`
- All message IDs converted to integers for API compatibility
- Added folder caching via `list_folders()` for efficient lookups
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### Added - OAuth2 Features
- **OAuth2 authorization code flow** - Interactive browser-based login
- **Automatic token refresh** - Access tokens refresh automatically when expired
- **Secure token storage** - Tokens stored in `~/.clawdbot/zoho-mail-tokens.json` with 600 permissions
- **Token management CLI** - Commands to check status, refresh, and revoke tokens
- **IMAP XOAUTH2 support** - OAuth2 authentication for IMAP connections
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### Security Improvements
- **No password storage** - OAuth2 eliminates password storage
- **Token-based auth** - Short-lived access tokens (1 hour)
- **Auto-refresh** - Seamless token renewal
- **Revocable access** - Easy to revoke without changing passwords
- **Secure file permissions** - Token files enforced to 600
The documentation states that the token file contains the client secret, access token, and refresh token, and also notes the file is not encrypted. A stolen refresh token and client secret can allow long-lived unauthorized access to the mailbox, so documenting and normalizing plaintext storage of all secrets in one file increases credential-compromise risk.
### Security
- **Permissions:** 600 (owner read/write only)
- **Contents:** Client ID, Client Secret, Access Token, Refresh Token
- **Encryption:** Not encrypted (store in secure location)
- **Version control:** Add to `.gitignore`
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
If refresh fails:
# Delete old tokens and set up again
rm ~/.clawdbot/zoho-mail-tokens.json
python3 scripts/oauth-setup.py
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
If refresh fails:
# Delete old tokens and set up again
rm ~/.clawdbot/zoho-mail-tokens.json
python3 scripts/oauth-setup.py
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Attack Vector:
/email search "; rm -rf /; echo "
/email search `whoami`
/email search $(cat /etc/passwd)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Attack Vector:
/email search "; rm -rf /; echo "
/email search `whoami`
/email search $(cat /etc/passwd)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Attack Vector:
/email search "; rm -rf /; echo "
/email search `whoami`
/email search $(cat /etc/passwd)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
/email search "; rm -rf /; echo "
/email search `whoami`
/email search $(cat /etc/passwd)
Fix:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Attack Example:
/email search "; rm -rf ~; echo "
Fix: New email-command-SECURE.js uses spawn() with argument arrays instead of shell interpolation. No shell metacharacters are processed.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Attack Example:
/email search "; rm -rf ~; echo "
Fix: New email-command-SECURE.js uses spawn() with argument arrays instead of shell interpolation. No shell metacharacters are processed.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Attack Example:
/email search "; rm -rf ~; echo "
Fix: New email-command-SECURE.js uses spawn() with argument arrays instead of shell interpolation. No shell metacharacters are processed.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Attack Example:
/email search "; rm -rf ~; echo "
Fix: New email-command-SECURE.js uses spawn() with argument arrays instead of shell interpolation. No shell metacharacters are processed.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Attack Example:
/email search "; rm -rf ~; echo "
Fix: New email-command-SECURE.js uses spawn() with argument arrays instead of shell interpolation. No shell metacharacters are processed.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Attack Example:**
An attacker could send an email with an attachment named:
- `../../../../etc/cron.d/backdoor` - Write to system cron
- `~/.ssh/authorized_keys` - Add SSH keys for persistence
- `../../.bashrc` - Execute code on shell login
**Fix:** Implemented `_sanitize_filename()` function that:
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
_output_path = safe_filename with open(safe_output_path, 'wb') as f: f.write(payload)
#### 6. Command Injection in Test Script (HIGH)
**Issue:** The `test-app-password.sh` script used `eval` to execute test commands with environment variables (`TEST_EMAIL`), allowing command injection if a malicious email address was provided.
**Attack Example:**
```bash
TEST_EMAIL="user@example.com' ; rm -rf / ; echo '" ./test-app-password.sh
Fix:
eval with bash -c for safer command executionTEST_RECIPIENT email format before any command execution^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$Impact: Prevents arbitrary command execution during testing. Script now exits immediately if an invalid email address is detected.
OAuth2 (Recommended):
# Run interactive setup
python3 scripts/oauth-setup.py
# Verify token file permissions
This variant includes a meaningful security concern beyond mere mismatch: the skill metadata and instructions normalize local storage of secrets and tokens in predictable paths under the user's home directory. While local token storage is common, documenting it without clear permission scoping, secure file creation practices, or encryption increases credential exposure risk on multi-user or poorly secured systems.
This variant includes a meaningful security concern beyond mere mismatch: the skill metadata and instructions normalize local storage of secrets and tokens in predictable paths under the user's home directory. While local token storage is common, documenting it without clear permission scoping, secure file creation practices, or encryption increases credential exposure risk on multi-user or poorly secured systems.
This variant includes a meaningful security concern beyond mere mismatch: the skill metadata and instructions normalize local storage of secrets and tokens in predictable paths under the user's home directory. While local token storage is common, documenting it without clear permission scoping, secure file creation practices, or encryption increases credential exposure risk on multi-user or poorly secured systems.
This variant includes a meaningful security concern beyond mere mismatch: the skill metadata and instructions normalize local storage of secrets and tokens in predictable paths under the user's home directory. While local token storage is common, documenting it without clear permission scoping, secure file creation practices, or encryption increases credential exposure risk on multi-user or poorly secured systems.
This variant includes a meaningful security concern beyond mere mismatch: the skill metadata and instructions normalize local storage of secrets and tokens in predictable paths under the user's home directory. While local token storage is common, documenting it without clear permission scoping, secure file creation practices, or encryption increases credential exposure risk on multi-user or poorly secured systems.
This variant includes a meaningful security concern beyond mere mismatch: the skill metadata and instructions normalize local storage of secrets and tokens in predictable paths under the user's home directory. While local token storage is common, documenting it without clear permission scoping, secure file creation practices, or encryption increases credential exposure risk on multi-user or poorly secured systems.
This variant includes a meaningful security concern beyond mere mismatch: the skill metadata and instructions normalize local storage of secrets and tokens in predictable paths under the user's home directory. While local token storage is common, documenting it without clear permission scoping, secure file creation practices, or encryption increases credential exposure risk on multi-user or poorly secured systems.
This variant includes a meaningful security concern beyond mere mismatch: the skill metadata and instructions normalize local storage of secrets and tokens in predictable paths under the user's home directory. While local token storage is common, documenting it without clear permission scoping, secure file creation practices, or encryption increases credential exposure risk on multi-user or poorly secured systems.