Moltbot Plugin 2do

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:13 AM UTC
• Version: 1.0.2

Overview

The skill does what it says, but its broad no-prefix task capture can send ordinary chat text out through email without a confirmation step.

Install only if you are comfortable with matched task text being emailed through your SMTP provider to 2Do. Use a dedicated SMTP account or app-specific password, configure the agent to invoke this skill only for explicit task-creation requests, and add or require a confirmation step before sending. Build the project so it runs the compiled `dist/main.js` path, or avoid the `npx` fallback.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The documented trigger phrases are broad enough to match ordinary conversational statements such as reminders or mentions of future plans, which can cause the skill to activate when the user did not intend to create or send a task. In this skill, unintended activation is more serious because activation results in external transmission of user content via email, potentially leaking private information or creating unwanted tasks.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The natural-language trigger definition is underspecified and lacks boundaries or negative examples, so the agent may interpret general text as an instruction to send a task externally. Because the skill is designed to parse free-form Chinese and English and then email the result, ambiguous scope increases the chance of accidental data exfiltration or unintended task creation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation states that user task content will be sent over SMTP to a configured mailbox but does not prominently warn that this is an external transmission of potentially sensitive content. Users may disclose personal schedules, work items, or secrets believing they are only interacting locally, when in fact the content is being sent through email infrastructure and stored by third parties.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The README explicitly advertises triggerless natural-language activation across broad chat platforms, which means ordinary conversational phrases can invoke the skill without a clear command boundary. In a messaging agent context, this creates a real risk of unintended task creation and silent exfiltration of user-entered content to external email infrastructure and the 2Do service.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The example phrases include common everyday expressions like reminders and mentions of future plans, with no disambiguation or opt-in syntax. In an always-listening agent environment, these ambiguous phrases increase the chance that normal conversation is misinterpreted as a command, causing unintended actions and disclosure of message content externally.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README states that task content is automatically sent via SMTP to 2Do, and later instructs users to configure SMTP credentials, but it does not prominently warn that user message content will leave the chat system and traverse third-party email/services. This is a privacy and data-handling risk, especially because tasks may contain sensitive personal or business information.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger description is extremely broad and includes many generic phrases about remembering, reminders, or mentioning future actions. In an agent environment, this can cause the skill to be invoked on ordinary conversation that the user did not intend to transmit to an external system, increasing the chance of unwanted task creation and data disclosure.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The statement that 'No-prefix input is also supported — the entire input becomes the task title' makes the activation scope dangerously broad. Any arbitrary user utterance could be converted into an outbound email task, which is especially risky because this skill sends content externally to a configured email address and may capture sensitive conversational data without clear consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description says it parses raw natural language and sends a formatted email to the user's configured 2Do inbox, but it does not clearly warn users that their task content is transmitted to an external email/SMTP service. This creates a privacy and data-handling risk, especially when broad triggering could cause unintended transmission of sensitive notes, reminders, or personal plans.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The package description advertises very broad natural-language triggers such as generic reminders, tasks, and statements about future activities, without clear constraints on when the skill should activate. In an agent ecosystem, this increases the chance of overbroad invocation and unintended exfiltration of user content to the skill, which is especially relevant because the skill forwards extracted task data externally via email.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manifest description says the skill creates tasks and sends them to 2Do via email, but it does not prominently warn that user-provided task content will leave the agent environment and be transmitted to an external email endpoint. This creates a transparency and consent problem that can lead to sensitive reminders, schedules, or personal notes being unintentionally disclosed.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Including the user's entire original input in the email body can expose far more information than is needed to create the task, such as unrelated personal details, credentials, internal project data, or contextual conversation text. In this skill, that leakage is amplified because the content is sent through SMTP and stored in an email inbox monitored by 2Do, increasing retention and third-party exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"skill"
  ],
  "dependencies": {
    "nodemailer": "^7.0.13"
  },
  "devDependencies": {
    "@tsconfig/node22": "^22.0.1",

• Confidence: 93% confidence
• Finding: Using a caret range for nodemailer allows future installs to resolve to newer minor or patch releases that may change behavior or introduce supply-chain risk. For a dependency that handles outbound email and untrusted content formatting, version drift weakens build reproducibility and can unexpectedly pull in insecure code.

Known Vulnerable Dependency: nodemailer==7.0.13 — 6 advisory(ies): GHSA-268h-hp4c-crq3 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-c7w3-x93f-qmm8 (Nodemailer has SMTP command injection due to unsanitized `envelope.size` paramet); GHSA-p6gq-j5cr-w38f (Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess) +3 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The manifest includes nodemailer 7.0.13, which is flagged with multiple advisories including CRLF/header injection, SMTP command injection, and controls bypass issues. This skill’s core function is to transform user natural-language input into outbound email, so a vulnerable mail library materially increases the risk that crafted task content could manipulate headers, SMTP commands, or message handling in ways that expose data or alter delivery.

Known Vulnerable Dependency: vitest==3.0.5 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: Vitest 3.0.5 is reported as vulnerable when its UI server is listening, potentially allowing arbitrary file read and execution. Because this is a dev/test dependency rather than part of the normal runtime plugin path, the practical exposure is reduced, but it still poses risk in developer or CI environments if the vulnerable mode is used.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.