ClawHub
Back to skill

Security audit

139mail

Security checks for vulnerabilities and agentic risk

Overview

This email skill does what it claims, but it handles mailbox credentials and email content with unsafe TLS and weak credential-file protections.

Review before installing. Use only an email authorization code, restrict config/email.json to owner-only permissions yourself, and avoid using this over untrusted networks unless IMAP TLS certificate validation is fixed. Be cautious with broad natural-language activation, sending attachments, and reading full mailbox content through an agent.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/email.js:68
Finding

IMAP TLS Certificate Validation Is Disabled

Content
View full analysis

Vulnerability Details

File Location: scripts/email.js:68-76 and scripts/email.js:149-157
Vulnerability Type: Improper certificate validation
Risk Level: High

The vulnerability appears in both IMAP connection paths:

js
const imap = new Imap({
  user: config.email,
  password: config.password,
  host: config.imap.host,
  port: config.imap.port,
  tls: config.imap.secure,
  tlsOptions: { rejectUnauthorized: false }
});

Technical Analysis

Setting rejectUnauthorized to false instructs the TLS client to accept certificates that cannot be validated against a trusted certificate authority. This defeats server authentication even when the IMAP connection uses TLS.

The client supplies config.email and config.password to the connected IMAP endpoint. Because the endpoint's identity is not verified, an attacker able to intercept or redirect network traffic can impersonate the configured mail server using an untrusted certificate. The issue affects both listEmails() and readEmail().

Sending credentials over the network is necessary for the declared IMAP functionality, but disabling certificate verification is not necessary and exceeds an acceptable minimum-risk implementation.

Attack Path

  1. The user invokes the list, read, or test command.
  2. The Skill connects to the host specified by config.imap.host.
  3. An attacker controlling DNS resolution, a network gateway, a proxy, or another network interception point redirects the connection to an attacker-controlled IMAP service.
  4. The attacker presents a self-signed, expired, or otherwise untrusted certificate.
  5. The client accepts the certificate because rejectUnauthorized is false.
  6. The client authenticates to the impersonated endpoint, potentially exposing the mailbox address and reusable authorization code.
  7. Depending on the negotiated authentication mechanism and interception environment, the attacker m ...[truncated 568 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the tlsOptions override and rely on Node.js certificate validation:
    js
    const imap = new Imap({
  user: config.email,
  password: config.password,
  host: config.imap.host,
  port: config.imap.port,
  tls: config.imap.secure
});
  • Alternatively, explicitly set rejectUnauthorized: true.
  • Fail closed and display a clear error when certificate validation fails.
  • If private mail infrastructure requires a custom certificate authority, accept a narrowly scoped CA file through configuration rather than disabling validation globally.
  • Validate that secure IMAP configurations use TLS and an appropriate port.
  • Apply the corrected TLS configuration consistently to both listEmails() and readEmail().
  • Rotate the configured mailbox authorization code if the Skill has previously been used over an untrusted network.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/email.js:10
Finding

Plaintext Credential File Permissions Are Claimed but Not Enforced

Content
View full analysis

Vulnerability Details

File Location: scripts/email.js:10-20; related claims in SKILL.md:103-105 and README.md:92-96
Vulnerability Type: Insecure storage and handling of mailbox credentials
Risk Level: Medium

The implementation reads a plaintext configuration containing the mailbox authorization code without checking or enforcing its permissions:

js
// 加载配置
const configPath = path.join(__dirname, '../config/email.json');
let config = {};

try {
  config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
} catch (err) {
  console.error('读取配置文件失败:', err.message);
  console.error('请检查 ~/.openclaw/skills/email/config/email.json');
  process.exit(1);
}

The documentation states that the file has already been restricted to its owner:

text
- 配置文件权限已设置为仅用户可读
text
- ⚠️ 配置文件已设置为仅用户可读 (chmod 600)

Technical Analysis

The configuration schema stores email and password values in plaintext. The script reads the file directly but does not create it with mode 0600, call chmod, inspect its ownership, or reject group/world-readable permissions.

Consequently, the effective protection depends entirely on how the user creates the file and the process umask. The documentation's assertion that permissions are already restricted is not supported by the implementation. Users may rely on that assurance and leave reusable mailbox credentials accessible to other local accounts or processes.

Attack Path

  1. A user manually creates or copies config/email.json as instructed by the documentation.
  2. The file receives permissive permissions due to the copy operation, archive extraction, editor behavior, or the user's umask.
  3. The Skill reads and uses the file without checking its mode or ownership.
  4. Another local user or process with filesystem access reads the plaintext password value.
  5. The attacker uses the authorization code against the configured IMAP or SM ...[truncated 731 chars]
Remediation
View remediation

Remediation Suggestions

  • Before reading the configuration, use fs.statSync() or its asynchronous equivalent to verify that the file is owned by the current user and is not readable or writable by group or other users.
  • Reject insecure permissions with an actionable error rather than silently loading the credentials.
  • If the Skill creates or copies the configuration, create it atomically with mode 0600.
  • Provide an explicit setup command such as:
    bash
    chmod 600 config/email.json
  • Correct the documentation so it does not claim that permissions have been enforced unless the implementation actually enforces them.
  • Prefer an operating-system credential store or supported secret-management facility over a plaintext JSON password where available.
  • Continue recommending provider-specific authorization codes rather than primary account passwords.
  • Avoid including credential values in logs and error messages.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

Known Vulnerable Dependency: linkify-it==5.0.0 — 2 advisory(ies): CVE-2026-48801 (LinkifyIt#match scan loop has quadratic algorithmic complexity); CVE-2026-59887 (linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on at)

High
Category
Supply Chain
Confidence
89% confidence
Finding

The lockfile pins linkify-it 5.0.0, which is flagged for quadratic-complexity parsing in URL/mailto matching. In this email skill, mailparser depends on linkify-it while processing potentially attacker-controlled email bodies, so a crafted message could trigger excessive CPU use and cause denial of service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==7.0.13 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more

High
Category
Supply Chain
Confidence
93% confidence
Finding

The bundled mailparser pulls in nodemailer 7.0.13, which has multiple published advisories including CRLF/header injection and content resolution bypass issues. Because this skill processes untrusted email content and may construct or transform messages, vulnerable nodemailer code in the dependency tree increases the risk of header manipulation, unsafe content access, or resource-exhaustion attacks.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==6.10.1 — 12 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +9 more

High
Category
Supply Chain
Confidence
95% confidence
Finding

The application directly depends on nodemailer 6.10.1, which is reported with multiple high-severity advisories such as CRLF injection in List-* headers and denial-of-service issues in address parsing. This skill's core purpose is sending email via SMTP, so user-supplied recipients, headers, subjects, or message fields may flow into the vulnerable library and make exploitation more realistic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: semver==5.3.0 — 1 advisory(ies): CVE-2022-25883 (semver vulnerable to Regular Expression Denial of Service)

High
Category
Supply Chain
Confidence
80% confidence
Finding

semver 5.3.0 is known to be vulnerable to ReDoS, but here it appears only as a transitive dependency of utf7 under imap. In this lockfile context, exploitation is less direct because semver is not obviously exposed to attacker-controlled version strings during normal email operations, so the practical risk to this skill is lower than the mail-handling library issues above.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==6.10.1 — 12 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +9 more

High
Category
Supply Chain
Confidence
98% confidence
Finding

This package allows installation of nodemailer versions affected by multiple published advisories, including header injection and content-access control bypass issues. In an email skill that sends user-influenced messages over SMTP, these flaws are especially relevant because crafted input could abuse mail composition or trigger denial of service or unintended file/network content access depending on implementation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill presents natural-language invocation examples only in Chinese, which can imply a required interaction language. The README does not state that Chinese is optional, nor does it document that the skill is intentionally limited to a Chinese-language or region-specific environment.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

md
- ⚠️ 配置文件存储在本地，**不要提交到 Git**
- ⚠️ 使用邮箱授权码而非登录密码
- ⚠️ 配置文件已设置为仅用户可读 (chmod 600)

## License

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill performs network-capable actions against external IMAP/SMTP servers but does not declare any tool scope or allowed-tools boundaries. That omission weakens policy enforcement and user transparency, making it easier for the skill to access the network without explicit restriction or review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation phrases are broad terms like '邮箱' and 'email', which can match ordinary conversation rather than a clear request to use the skill. This can cause unintended activation, potentially exposing mailbox contents or sending mail when the user only meant to discuss email conceptually.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description explains functionality but does not clearly warn users that message content, recipient data, and mail metadata will be transmitted to third-party mail servers. In a mail-handling skill, this lack of disclosure increases privacy and consent risk because users may not realize external transmission occurs when the skill activates.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Comments, errors, help output, and examples are presented exclusively in Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. This is a natural-language policy concern because it forces a locale/language experience without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code sends email via SMTP and connects to IMAP using configured credentials, which transmits user content and account data over the network. Although there is usage text, there is no explicit warning, confirmation, or comment disclosing these privacy-relevant network operations in the command paths themselves.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill implements full email body retrieval and supports sending arbitrary local file attachments, which expands data access and exfiltration capability beyond the more limited inbox-list/unread-view scope described in the skill metadata. In an agent setting, this increases the risk that a prompt or chained action could cause sensitive mailbox contents or local files to be disclosed without the user understanding the full capability surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest description is written entirely in Chinese and does not indicate that the skill is region-specific or that users can choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"test": "node scripts/test.js"
  },
  "dependencies": {
    "imap": "^0.8.19",
    "nodemailer": "^6.9.0",
    "mailparser": "^3.6.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
},
  "dependencies": {
    "imap": "^0.8.19",
    "nodemailer": "^6.9.0",
    "mailparser": "^3.6.0"
  },
  "keywords": [

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"dependencies": {
    "imap": "^0.8.19",
    "nodemailer": "^6.9.0",
    "mailparser": "^3.6.0"
  },
  "keywords": [
    "openclaw",

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The diagnostic command prints the configured mailbox address and IMAP/SMTP server details to stdout, which can expose account and infrastructure information in logs, terminal history, or higher-level agent transcripts. While not a direct compromise by itself, this unnecessarily broadens the disclosure of sensitive configuration metadata.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/email.js:76