Sales Email Automation (IMAP/SMTP)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:57 AM UTC
• Version: 1.0.0

Overview

This email skill has useful IMAP/SMTP features, but it also processes real mail through CRM, Discord, OpenRouter, local archives, and unsafe shell commands that create serious review concerns.

Review carefully before installing. Do not run this against a production mailbox until the execSync command injections are replaced with argument-safe APIs, live tests default to dry-run, external AI/CRM/Discord data flows are explicit opt-in, and local archives/drafts/logs have restrictive permissions and retention. If already installed, disable any cron job and rotate mail, Discord, OpenRouter, and CRM credentials after reviewing exposure.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: auto-capture.js:73

Finding

Remote Command Injection Through Attacker-Controlled Email Sender Data

Content

View full analysis

/, '').trim() || ''; const okkiMatch = await searchOkkiCustomer(email, companyName); ``` ### Technical Analysis `execSync()` receives a command string that is interpreted by a shell. Both `domain` and `companyName` originate from an untrusted email `From` header and are interpolated directly inside double quotes. Double quotes do not neutralize shell command substitution, and an attacker can also inject a closing quote followed by shell operators. The filename of the vector-search script is configurable, but neither that path nor the untrusted query is passed as a discrete process argument. Because automatic capture can process remotely supplied messages, this flaw creates a remote-to- ...[truncated 1166 chars]

Remediation

View remediation

?` expression. - Apply strict length and character limits to search terms. - Run automatic mail processing in a sandbox with no access to unrelated secrets or files. - Add regression tests containing quotes, semicolons, command substitutions, newlines, and shell operators. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: kb-retrieval.js:19

Finding

Command Injection Through Email- and LLM-Derived Knowledge-Base Queries

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/smtp-wrapper.js:20

Finding

Command Injection in the SMTP Wrapper

Content

View full analysis

Remediation

View remediation

other

Error

• Location: intent-recognition.js:94

Finding

Undisclosed Transmission of Customer Email and Knowledge-Base Data to OpenRouter

Content

View full analysis

0) { prompt += `KNOWLEDGE BASE CONTEXT:\n`; kbResults.results.forEach((r, i) => { prompt += `\n[${i + 1}] Source: ${r.source || 'Unknown'}\n${r.content?.slice(0, 300) || r}\n`; }); } const response = await fetch('https://openrouter.ai/api/v1/chat/completions', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${process.env.OPENROUTER_API_KEY}`, 'HTTP-Referer': ' ...[truncated 2497 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: integration-test.js:33

Finding

Integration Test Defaults to Processing Real Mailbox Data and Live Discord Publication

Content

View full analysis

a.startsWith('--limit='))?.split('=')[1]) || 3; console.log('Integration test started'); console.log(`Mode: ${DRY_RUN ? 'DRY-RUN' : 'LIVE'}`); ``` The test reads recent messages from the real inbox: ```js imap.openBox('INBOX', false, (err, box) => { imap.search(['ALL'], (err, results) => { const fetchSeq = results.slice(-limit).reverse(); const f = imap.fetch(fetchSeq, { bodies: '', markSeen: false }); f.on('message', (msg) => { msg.on('body', (stream) => { simpleParser(stream, (err, parsed) => { if (!err && parsed) { emailData = { uid: msg.seqno, from: parsed.from?.text || parsed.from?.value?.[0]?.address || 'unknown', to: parsed.to?.text || '', subject: parsed.subject || 'No Subject', body: parsed.text || parsed.html || '', receivedAt: parsed.date?.toISOString() || new Date().toISOString(), attachments: parsed.attachments?.map(a => a.filename) || [] }; } }); }); }); }); }); ``` It publishes the generated result to Discord unless `--dry-run` is explicitly supplied: ```js if (result.draft && !DRY_RUN) { console.log('\nStep 4: Discord publication'); try { const reviewResult = await sendForReview(result.draft); result.discord_sent = true; result.discord_message_id = reviewResult.message_id; } catch (err) { result.errors.push(`Discord send failed: ${err.message}`); } } ``` It also searches for credentials in a parent workspace: ```js const envPath = path.join(__dirname, ...[truncated 2059 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: auto-capture.js:128

Finding

Automatic Plaintext Archiving of Complete Email and CRM Data

Content

View full analysis

]*>/g, '') || 'No body'}\n`; if (emailData.attachments && emailData.attachments.length > 0) { emailData.attachments.forEach((att, i) => { content += `${i + 1}. ${att.filename} (${(att.size / 1024).toFixed(2)} KB)\n`; }); } fs.writeFileSync(filepath, content, 'utf8'); return filepath; } ``` ### Technical Analysis The capture workflow stores complete email bodies, sender and recipient identities, ...[truncated 1731 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (134)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document explicitly forbids sending example quotation files to customers, yet the provided command example attaches a file from the examples directory. This contradiction creates a high likelihood of operator error that can leak incorrect, non-customer-specific, or test materials to real recipients, causing data integrity, privacy, and reputational harm.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Later attachment guidance labels examples/QT-*.pdf as acceptable quotation attachments, directly conflicting with earlier warnings that example files must never be sent to customers. In an email-sending skill, contradictory guidance around attachments is dangerous because it can operationalize accidental disclosure of sample or wrong-customer sales documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared OKKI sync of outgoing email data would be a meaningful privacy and integrity concern in an email skill. Syncing outgoing communications into CRM systems expands data exposure beyond the mail provider and can leak sensitive commercial data if users are not clearly informed.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.

md

- OKKI sync: `okki-sync.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

md

- Discord review: `discord-review.js`

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code invokes external local programs via execSync to perform vector/OKKI searches using email-derived data. This creates a dangerous trust boundary expansion: sensitive email metadata is sent into other local tools outside the advertised mail functionality, increasing exposure risk and making the skill capable of triggering unintended local code paths or data access.

Content

No source excerpt is available for this finding.