Security audit

quiet-mail

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed email API skill, but it needs review because it ships live-looking SMTP credentials, weak secret storage defaults, and no enforced anti-abuse limits for account creation or sending.

Treat this as a review-required email service, not a drop-in safe skill. Before installing or deploying it, remove and rotate the embedded SMTP credentials, replace default database credentials, avoid exposing PostgreSQL publicly, add real signup and sending quotas, protect API keys and mailbox passwords with hashing/encryption, and upgrade vulnerable dependencies. Do not expose it to the public internet in its current form.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: test_send_email_direct.py:13
Finding: Hard-Coded SMTP Credentials for the Bob Mailbox
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: test_testbot_smtp.py:13
Finding: Hard-Coded SMTP Credentials for the Test-Bot Mailbox
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: app/models.py:15
Finding: Plaintext Storage of API Keys and Mailbox Passwords
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: docker-compose.yml:7
Finding: PostgreSQL Published with Predictable Default Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: app/routes/agents.py:31
Finding: Unauthenticated Mailbox Provisioning and Unenforced Sending Limits
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: app/routes/health.py:17
Finding: Unauthenticated Health Endpoint Discloses Raw Database Errors
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (100)

Known Vulnerable Dependency: python-jose==3.3.0 — 5 advisory(ies): CVE-2024-33663 (python-jose algorithm confusion with OpenSSH ECDSA keys); CVE-2024-33664 (python-jose denial of service via compressed JWE content); CVE-2024-33663 (python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and ot) +2 more

Critical

Category: Supply Chain
Confidence: 99% confidence
Finding: python-jose==3.3.0 carries critical advisories including algorithm confusion, which is especially dangerous in a dependency explicitly used for authentication and token handling. If the skill verifies attacker-supplied JWTs or JWE data, these flaws could enable authentication bypass, token forgery acceptance, or denial of service.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 43)May include surrounding context.

Configure environment:

bash
cp .env.example .env # Edit .env with your settings nano .env

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 44)May include surrounding context.

Configure environment:

bash
cp .env.example .env # Edit .env with your settings nano .env

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 45)May include surrounding context.

Configure environment:

bash
cp .env.example .env # Edit .env with your settings nano .env

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: The README exposes a destructive DELETE endpoint without documenting authorization requirements, confirmation controls, or ownership checks. In an agent-oriented API, under-specified destructive operations increase the chance of accidental or malicious deletion of agent accounts and associated mail data if access control is weak or misunderstood.
Content: Scanner excerpt · README.md (reported line 125)May include surrounding context.
md
- `GET /health` - Health check - `POST /agents` - Create agent (no auth) - `GET /agents/{id}` - Get agent details - `DELETE /agents/{id}` - Delete agent - `POST /agents/{id}/send` - Send email - `GET /agents/{id}/emails` - List inbox - `GET /agents/{id}/sent` - List sent emails

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · app/config.py (reported line 47)May include surrounding context.
python
STORAGE_LIMIT_MB: int = 1024 # 1GB per agent class Config: env_file = ".env" case_sensitive = True

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · examples/1-create-agent.sh (reported line 8)May include surrounding context.
sh
echo "Creating AI agent..." response=$(curl -s -X POST "$API_BASE/agents" \ -H "Content-Type: application/json" \ -d '{ "id": "my-agent",

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · examples/2-send-email.sh (reported line 20)May include surrounding context.
sh
echo "Sending email..." response=$(curl -s -X POST "$API_BASE/agents/$AGENT_ID/send" \ -H "Authorization: Bearer $QUIETMAIL_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/2-send-email.sh (reported line 7)May include surrounding context.
sh
API_BASE="https://api.quiet-mail.com" AGENT_ID="my-agent" # Get API key from environment or file if [ -z "$QUIETMAIL_API_KEY" ]; then if [ -f ~/.quietmail_key ]; then QUIETMAIL_API_KEY=$(cat ~/.quietmail_key)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/3-list-sent.sh (reported line 7)May include surrounding context.
sh
API_BASE="https://api.quiet-mail.com" AGENT_ID="my-agent" # Get API key from environment or file if [ -z "$QUIETMAIL_API_KEY" ]; then if [ -f ~/.quietmail_key ]; then QUIETMAIL_API_KEY=$(cat ~/.quietmail_key)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · examples/3-list-sent.sh (reported line 19)May include surrounding context.
sh
echo "Fetching sent emails..." response=$(curl -s "$API_BASE/agents/$AGENT_ID/sent?limit=10" \ -H "Authorization: Bearer $QUIETMAIL_API_KEY") echo "$response" | python3 -m json.tool

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

Category: Supply Chain
Confidence: 89% confidence
Finding: The dependency pin fastapi==0.109.0 is flagged with a known security advisory, so keeping this exact version exposes the application to publicly documented weaknesses inherited from the framework. In a web API skill, framework vulnerabilities are directly reachable from untrusted network input, which increases practical exploitability.
Content: No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: python-multipart==0.0.6 — 16 advisory(ies): CVE-2024-24762 (python-multipart vulnerable to Content-Type Header ReDoS); CVE-2024-53981 (Denial of service (DoS) via deformation `multipart/form-data` boundary); CVE-2026-53539 (python-multipart: Quadratic-time querystring parsing with semicolon separators c) +13 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: python-multipart==0.0.6 has multiple reported vulnerabilities including ReDoS and multipart boundary parsing DoS issues. Because this skill uses FastAPI and likely processes form or file uploads, malformed attacker-controlled Content-Type headers or multipart bodies could trigger excessive CPU consumption or request handling failures.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code embeds a real SMTP username and password directly in source and uses them to send outbound email to an external service. Hardcoded credentials are highly sensitive secrets that can be reused by anyone with code access, enabling unauthorized mail sending, account abuse, spam, phishing, and possible lateral compromise if the password is reused elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code performs a real outbound email send using embedded credentials with no warning, consent, or runtime guard, which can enable unauthorized message transmission if the script is executed. In this context, the presence of live credentials makes the network action materially more dangerous because it can be immediately abused for impersonation, spam, or testing account compromise.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The test directly queries the database to retrieve live API keys, bypassing normal authentication controls and exposing secrets to any user or process able to run the test. Hardcoded database credentials combined with secret extraction make this especially risky if the file is reused outside an isolated local environment or committed into shared infrastructure.
Content: Scanner excerpt · tests/phase2_test.py (reported line 32)May include surrounding context.
python
def get_api_key(agent_id): """Get API key from database""" conn = psycopg2.connect(DB_CONN) cur = conn.cursor() cur.execute('SELECT api_key FROM agents WHERE id = %s', (agent_id,))

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: Advertising 'No verification required' for an email-sending platform materially lowers barriers to automated account creation and abuse by agents. In the context of unlimited sending and agent automation, this increases the likelihood of spam, impersonation campaigns, and large-scale misuse if integrated without additional safeguards.
Content: Scanner excerpt · API.md (reported line 5)May include surrounding context.
md
**Base URL:** `https://api.quiet-mail.com` (or `http://127.0.0.1:8000` for local) **Philosophy:** Simple, unlimited email for AI agents. No verification required. ---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · API.md (reported line 11)May include surrounding context.
Quick Start

1. Create an Agent

bash
curl -X POST https://api.quiet-mail.com/agents \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · API.md (reported line 14)May include surrounding context.
1. Create an Agent

bash
curl -X POST https://api.quiet-mail.com/agents \ -H "Content-Type: application/json" \ -d '{ "id": "my-agent",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · API.md (reported line 14)May include surrounding context.
1. Create an Agent

bash
curl -X POST https://api.quiet-mail.com/agents \ -H "Content-Type: application/json" \ -d '{ "id": "my-agent",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · API.md (reported line 41)May include surrounding context.
1. Create an Agent

bash
curl -X POST https://api.quiet-mail.com/agents \ -H "Content-Type: application/json" \ -d '{ "id": "my-agent",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · API.md (reported line 65)May include surrounding context.
1. Create an Agent

bash
curl -X POST https://api.quiet-mail.com/agents \ -H "Content-Type: application/json" \ -d '{ "id": "my-agent",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · API.md (reported line 311)May include surrounding context.
1. Create an Agent

bash
curl -X POST https://api.quiet-mail.com/agents \ -H "Content-Type: application/json" \ -d '{ "id": "my-agent",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · API.md (reported line 319)May include surrounding context.
1. Create an Agent

bash
curl -X POST https://api.quiet-mail.com/agents \ -H "Content-Type: application/json" \ -d '{ "id": "my-agent",

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Credential Access

Credential Access

Tool Parameter Abuse

Credential Access

External Script Fetching

External Script Fetching

Credential Access

Credential Access

External Script Fetching

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

Context-Inappropriate Capability

Missing User Warnings

Credential Access

Autonomous Decision Making

Session Persistence

Quick Start

1. Create an Agent

External Transmission

1. Create an Agent

External Transmission

1. Create an Agent

External Transmission

1. Create an Agent

External Transmission

1. Create an Agent

External Transmission

1. Create an Agent

External Transmission

1. Create an Agent

Static analysis