Security audit

Proton Mail

Security checks for vulnerabilities and agentic risk

Overview

This skill is for ProtonMail browser automation, but it includes bot-detection bypass and disables Chromium sandboxing while handling sensitive email access.

Review before installing. This skill can access and send mail from a ProtonMail account, asks users to provide credentials through environment variables, and includes automation-evasion settings plus disabled browser sandboxing. Use only on accounts you control, avoid privileged execution, pin dependencies, and remove stealth and no-sandbox launch arguments before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:56
Finding: Chromium Process Sandbox Disabled During Sensitive Mailbox Automation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 50–59, 77–80, and 195–198 **Vulnerability Type**: Browser sandbox disabled through insecure launch configuration **Risk Level**: High ### Vulnerable Code ```javascript await chromium.launch({ headless: true, args: [ '--disable-blink-features=AutomationControlled', '--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage' ] }); ``` The same unsafe option is included in the login and complete examples: ```javascript const browser = await chromium.launch({ headless: true, args: ['--disable-blink-features=AutomationControlled', '--no-sandbox'] }); ``` ### Technical Analysis The documented Playwright configurations explicitly start Chromium with `--no-sandbox`, and one configuration additionally uses `--disable-setuid-sandbox`. These arguments disable important Chromium process-isolation controls. The browser processes untrusted remote material, including the ProtonMail web application and potentially attacker-controlled email content. A renderer, JavaScript engine, image parser, or other browser vulnerability could therefore be encountered while the process holds access to an authenticated mailbox session. The document presents sandbox disabling as part of bot-detection evasion, but Chromium sandbox disabling is not necessary for the declared mailbox-management functionality. Concealing `navigator.webdriver` and disabling the Blink automation feature do not require disabling the operating-system sandbox. ### Attack Path 1. An attacker sends a crafted email containing content intended to trigger a browser or rendering-engine vulnerability. 2. The operator runs the documented Skill configuration, launching Chromium with `--no-sandbox`. 3. The automation logs into ProtonMail and opens or renders the attacker-controlled message. 4. The malicious content exploits a compatible Chromium vulnerability. 5. Because browser sandbox isolation is disabled, ...[truncated 1152 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both unsafe launch arguments from every example: ```javascript const browser = await chromium.launch({ headless: true, args: ['--disable-blink-features=AutomationControlled'] }); ``` 2. Run Chromium under an unprivileged, dedicated operating-system account. 3. Keep Playwright and its managed Chromium release updated with tested security patches. 4. If a constrained container environment cannot support Chromium’s standard sandbox, use a hardened container with: - A non-root user. - A read-only root filesystem. - Dropped Linux capabilities. - Seccomp and AppArmor or SELinux policies. - No host filesystem mounts containing secrets. - Strict network egress restrictions. 5. Do not expose mailbox passwords to the browser process longer than necessary. Prefer a securely stored, short-lived authenticated session where operationally supported. 6. Treat email content as untrusted and avoid opening unnecessary attachments or external resources during automation. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:6
Finding: Unpinned Playwright Dependency and Browser Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6, 35–36, and 249 **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code The package installation metadata does not specify a version: ```text metadata: {"clawdbot":{"emoji":"📧","requires":{"bins":["playwright","node"]},"install":[{"id":"npm","kind":"npm","package":"playwright","bins":["npx playwright"],"label":"Install Playwright (npm)"},{"id":"chromium","kind":"exec","command":"npx playwright install chromium","label":"Install Chromium browser"}]}} ``` The installation instructions likewise resolve an unspecified Playwright version: ```bash npm install playwright npx playwright install chromium ``` The troubleshooting instructions repeat executable dependency invocation: ```bash npx playwright install chromium ``` ### Technical Analysis The Skill directs users and automated installers to install `playwright` without an exact version, lockfile, or documented integrity verification. Consequently, installation results can change over time even when the Skill itself has not changed or been reviewed again. The Playwright package name and referenced Proton domains appear legitimate; there is no evidence in the audited file of typosquatting or a deliberately malicious package. The weakness is the mutable, unpinned supply-chain dependency. If the package, npm account, package registry, dependency graph, or dependency-resolution environment were compromised, installation could introduce attacker-controlled code. The `npx playwright install chromium` command executes the resolved Playwright command and downloads a corresponding browser binary. Both the executable package resolution and downloaded browser artifact therefore form part of the trusted supply chain. ### Attack Path 1. An attacker compromises a relevant npm publishing account, registry response, dependency, or package-resolution path. 2. A malicious or otherwise unsafe ...[truncated 1409 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Playwright to an exact reviewed version in the Skill metadata and installation documentation, for example: ```bash npm install --save-exact playwright@<reviewed-version> ``` 2. Provide a committed `package.json` and `package-lock.json`, then use: ```bash npm ci ``` 3. Review and update the pinned version through a controlled dependency-update process rather than resolving the latest release during installation. 4. Verify npm package provenance and lockfile integrity before installation. 5. Ensure the Chromium binary installed by Playwright corresponds to the reviewed, pinned Playwright release. 6. Perform dependency installation as an unprivileged user in an isolated build environment. 7. Avoid exposing ProtonMail credentials during dependency installation. 8. Consider disabling lifecycle scripts during initial package acquisition where compatible with the validated installation process, and explicitly review any scripts that must be enabled. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The skill directly instructs impersonation of human browsing behavior by hiding automation fingerprints. This materially increases abuse potential because it is designed to evade detection by the service operator while automating access to a sensitive email platform.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises login, inbox reading, sending, and mailbox management for an encrypted email service but does not prominently warn about privacy, account takeover, sending abuse, or compliance risks. In context, the skill handles highly sensitive communications, so underemphasizing risk makes misuse and unsafe deployment more likely.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This is a duplicate instance of the same unpinned `npx playwright` reference in the metadata. Unpinned package execution creates a supply-chain risk, especially in a skill that logs into ProtonMail and can access or send private email.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The requirements section instructs `npx playwright install chromium` without binding the toolchain to an exact Playwright version. While the browser install itself is common, leaving the package version floating undermines reproducibility and increases supply-chain exposure.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: ### System Dependencies (Linux) ```bash # Ubuntu/Debian sudo apt-get update sudo apt-get install -y libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2 libpango-1.0-0 libcairo2 # Raspberry Pi / ARM
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: ### System Dependencies (Linux) ```bash # Ubuntu/Debian sudo apt-get update sudo apt-get install -y libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2 libpango-1.0-0 libcairo2 # Raspberry Pi / ARM
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: ### System Dependencies (Linux) ```bash # Ubuntu/Debian sudo apt-get update sudo apt-get install -y libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2 libpango-1.0-0 libcairo2 # Raspberry Pi / ARM
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The documentation explicitly includes bot-detection evasion measures such as disabling automation indicators and redefining `navigator.webdriver` to impersonate human browsing. This is not necessary for ordinary mailbox automation and crosses into stealth behavior that can facilitate policy evasion, abuse of third-party services, and concealment of automated access.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The troubleshooting guidance again uses `npx playwright install chromium` without a pinned version. Repeatedly encouraging floating package resolution increases the chance users execute unexpected code from the package registry.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: The manifest only states browser-based email management functionality. The documentation adds a separate capability of sourcing credentials from process environment variables, which is credential-access behavior not declared in the skill description and may exceed the expected scope for a narrowly described mail-management skill.

Static analysis

No suspicious patterns detected.