ClawHub
Back to skill

Security audit

zmail

Security checks for vulnerabilities and agentic risk

Overview

This email skill is coherent, but should be reviewed because it recommends unpinned npm/npx execution for a tool that will handle mailbox credentials and email content.

Before installing, review and pin the `@cirne/zmail` package version instead of running latest via npm or npx, avoid sudo, and avoid putting real IMAP or OpenAI secrets in command-line arguments or chat transcripts. Use the skill only for mailboxes whose owner accepts local caching and OpenAI/enrichment-provider processing of email-derived content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:72
Finding

Unpinned npm Package Installation Creates a Mutable Supply-Chain Execution Path

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:72-78
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Relevant code:

bash
## Install

```bash
node -v   # must be v20+
npm install -g @cirne/zmail
  • If better-sqlite3 fails to load (wrong Node ABI), the CLI may rebuild automatically on first run; if not, run npm rebuild better-sqlite3 using the same node binary that runs zmail.
  • Global install note: npm may install to a directory that is not on PATH; ensure that global bin is on PATH, or use npx @cirne/zmail for one-off commands.
text

The same unpinned commands also appear in `SKILL.md:5`, `SKILL.md:43`, and `SKILL.md:60`.

### Technical Analysis

The Skill instructs users or agents to install and execute `@cirne/zmail` without specifying an exact package version or integrity value. Both `npm install -g @cirne/zmail` and one-off execution through `npx @cirne/zmail` resolve a mutable package release from the npm registry.

The audited project contains only documentation and does not include the implementation of the installed package. Consequently, the executable code that receives IMAP and OpenAI credentials is outside the reviewed artifact and may change after this Skill is approved. npm package lifecycle scripts and runtime code can execute with the privileges of the user invoking npm. The global installation recommendation also places the executable in a shared command search path, increasing the consequences of a compromised release.

This is necessary only insofar as the Skill depends on the external zmail CLI. Resolving and executing the latest available version is not the minimum privilege or minimum trust approach required for that functionality; the dependency can instead be pinned and verified.

### Attack Path

1. An attacker compromises the npm publisher account, package registry entry, or a transitive dependency used by
...[truncated 1264 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the package to a reviewed exact version, for example npm install --global @cirne/zmail@0.1.2, rather than resolving the latest release.
  2. Keep the version in the installation command synchronized with the audited Skill metadata.
  3. Publish and verify package integrity information and npm provenance before installation.
  4. Prefer a project-local, lockfile-backed installation over a global installation where practical.
  5. Avoid unversioned npx execution. If npx is retained, specify the exact version and prevent unexpected package resolution.
  6. Review package lifecycle scripts and consider installing with scripts disabled when compatible, followed by an explicit, audited native dependency build step.
  7. Include the executable source or a verifiable source commit in the audit scope so the implementation receiving mailbox credentials can be reviewed.
  8. Explicitly warn users not to run the npm installation with sudo or another elevated account.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:123
Finding

Setup Example Exposes IMAP and OpenAI Secrets Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:123-129
Vulnerability Type: Sensitive credentials passed as command-line arguments
Risk Level: Medium

Relevant code:

bash
**Examples:**

```bash
zmail setup \
  --email 'user@gmail.com' \
  --password 'abcdefghijklmnop' \
  --openai-key 'sk-...'
text

### Technical Analysis

The setup example encourages users to replace placeholder values with a real IMAP app password and OpenAI API key directly in command-line arguments. Command-line secrets can be recorded in shell history, terminal transcripts, CI logs, agent transcripts, process-monitoring systems, and audit telemetry. Depending on the operating system and process configuration, another local process or user may also be able to inspect active process arguments.

The Skill separately advises users not to paste secrets into chat logs and presents environment variables as an alternative, but the explicit flag-based example conflicts with that guidance. Passing credentials in process arguments is not required for the declared setup functionality and exceeds the minimum necessary exposure. Protected interactive input, standard input, a credential manager, or a securely permissioned configuration file can provide the same values without exposing them in the process argument vector.

### Attack Path

1. A user copies the documented setup command and substitutes the placeholders with genuine credentials.
2. The shell stores the command in its history, or an automation platform records it in execution logs.
3. Alternatively, a local process monitor captures the zmail process argument vector while setup is running.
4. An attacker with access to the history file, logs, transcript, or process metadata extracts the IMAP password and OpenAI API key.
5. The attacker uses the IMAP credential to access the mailbox or uses the API key to make requests at the victim's expense.

### Impact Assessment

Exposu
...[truncated 615 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the example that places real secrets in --password and --openai-key arguments.
  2. Prefer interactive hidden prompts for human setup so secrets are not echoed or stored in command history.
  3. For automation, support reading secrets from standard input, dedicated file descriptors, or an operating-system credential manager.
  4. If environment variables are required, inject them through the execution environment or a protected secret manager rather than typing an export command containing the secret into an interactive shell.
  5. Create ZMAIL_HOME/.env with owner-only permissions, such as mode 0600, and validate its ownership and permissions before use.
  6. Ensure setup and validation errors redact passwords and API keys from logs and structured output.
  7. Document cleanup procedures for accidental exposure, including removing affected shell history and logs and rotating both credentials.
  8. Deprecate secret-bearing command-line flags or clearly label them as unsafe for shared systems, CI logs, and recorded agent sessions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
t—zmail uses them to disclose the next capability ([Canonical docs & discovery](references/CANONICAL-DOCS.md)).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md
t—zmail uses them to disclose the next capability ([Canonical docs & discovery](references/CANONICAL-DOCS.md)).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
t—zmail uses them to disclose the next capability ([Canonical docs & discovery](references/CANONICAL-DOCS.md)).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
- **When:** Real terminal with TTY; user is present to answer prompts.
- **Run:** `zmail wizard`  
  Optional: `--no-validate` (skip live IMAP/OpenAI checks), `--clean` (wipe local config + cached mail under `ZMAIL_HOME`; IMAP unchanged; may prompt unless `--yes`).
- **If stdin is not a TTY** (agents, CI, pipes): wizard **exits** with a message to use **`zmail setup`** instead.
- Wizard walks through email, IMAP app password, OpenAI key, default sync window, and can **start background sync** at the end.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
- **When:** Real terminal with TTY; user is present to answer prompts.
- **Run:** `zmail wizard`  
  Optional: `--no-validate` (skip live IMAP/OpenAI checks), `--clean` (wipe local config + cached mail under `ZMAIL_HOME`; IMAP unchanged; may prompt unless `--yes`).
- **If stdin is not a TTY** (agents, CI, pipes): wizard **exits** with a message to use **`zmail setup`** instead.
- Wizard walks through email, IMAP app password, OpenAI key, default sync window, and can **start background sync** at the end.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The manifest description itself advertises npx @cirne/zmail without version pinning, which may be consumed by registries, UIs, or automation exactly as written. That broadens the blast radius of the supply-chain risk by encouraging unpinned execution in downstream tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill recommends executing npx @cirne/zmail without a version pin, which causes code to be fetched and run at invocation time from the registry. This creates a supply-chain risk: a future malicious or compromised package release could execute unexpected code in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line again instructs use of unpinned npx @cirne/zmail, which allows the executed artifact to vary over time based on whatever version is latest in the package registry. In an agent skill context, that weakens reproducibility and opens a realistic path for registry compromise or malicious package updates to become code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The guidance that users may use npx @cirne/zmail for one-off invocations still relies on unpinned remote package execution. Even if intended for convenience, this pattern is dangerous because agents may run it automatically, pulling unreviewed code at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The install section repeats the unpinned npx @cirne/zmail pattern, preserving the same supply-chain and reproducibility risk. Because this skill handles email, credentials, and local mail storage, compromise of the invoked package could expose sensitive mailbox data and secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.