Security audit

Qq Email

Security checks for vulnerabilities and agentic risk

Overview

This QQ Mail skill is generally aligned with email use, but it handles mailbox credentials and saved attachments in ways that deserve careful review before installation.

Install only if you are comfortable giving this skill QQ Mail send/read access. Prefer a narrowly scoped secret mechanism over TOOLS.md, revoke the QQ authorization code if it may have been exposed, and avoid using --save on untrusted emails until attachment filenames are sanitized and overwrite protection is added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: qq_email.py:465
Finding: Path Traversal Through Untrusted Email Attachment Filenames
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: qq_email.py:53
Finding: Mailbox Authorization Code Stored in a Shared Plaintext Workspace File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README is written entirely in Chinese and instructs the user to invoke the skill with Chinese phrases such as '你可以直接对我说', implying a fixed language expectation. There is no indication that users may interact in another language or that the Chinese-only constraint is required for a region-specific compliance reason.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to place the QQ Mail authorization code in TOOLS.md, a plaintext file, without clearly warning that this stores reusable credentials unencrypted on disk. In an agent/workspace context, such files are more likely to be read by other tools, accidentally committed, included in logs, or exposed to other users on the same system, enabling unauthorized email access and abuse of the mailbox.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill exposes capabilities that can access environment/configuration data, read local files, and perform network communication, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the skill's effective authority broader and less auditable, increasing the risk of unintended data access or exfiltration if the underlying script is misused or modified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The read command advertises a '--save' option for attachments without warning that untrusted email attachments will be written to local disk. This can lead users or agents to persist potentially sensitive or malicious files unintentionally, creating risks of local data exposure, unsafe follow-on handling, or accidental execution/opening of downloaded content.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · qq_email.py (reported line 191)May include surrounding context.
python
recipients = [email.strip() for email in to_email.split(",")] try: # Create message if attachment: msg = MIMEMultipart() msg.attach(MIMEText(content, "html" if html else "plain", "utf-8"))

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes the skill as being for sending, receiving, checking inbox, and reading messages. The implementation includes a separate mark_as_read capability that changes remote mailbox state, which goes beyond the stated read-oriented inbox functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: When --save is used, attachments are written to disk, defaulting to ~/Downloads, without strong user-facing disclosure of the destination or risks of saving untrusted files. In an agent skill context, this can lead to silent persistence of attacker-controlled content on the host, which may later be opened or processed by the user or other software.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: User-facing output strings such as 主题, 发件人, 收件人, 日期, and 状态 are hard-coded in Chinese, even though the rest of the tool description and command interface are in English. This imposes a specific language on users without opt-in or justification, which matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README first describes a subcommand interface for send/receive/read/mark-read operations, e.g. qq_email.py send ... and qq_email.py receive ... at L47-L95. But L97-L147 switches to examples and an argument table implying qq_email.py can be invoked directly with --to/--subject/--content, which contradicts the earlier documented command structure and could misrepresent how the tool actually works.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill's stated purpose is email transmission and retrieval, but it also implements local credential discovery by reading ~/.openclaw/workspace/TOOLS.md. While this may be an operational convenience, it is an additional local file access capability not directly described in the manifest itself.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.