quiet-mail

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:36 AM UTC
• Version: 1.0.0

Overview

This is a real email-sending skill, but it needs review because it enables broad agent-controlled outbound email and ships live-looking plaintext mail credentials in test scripts.

Install only if you intentionally want an agent to control an external email account. Remove and rotate the bundled SMTP credentials before use, avoid running the live SMTP test scripts, restrict recipients and sending volume, require explicit human approval before outbound mail, and treat quiet-mail API keys and mailbox passwords as secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The endpoint documentation explicitly warns that deletion permanently removes the agent and all emails, but the code only sets `deleted_at` in the database and then performs mailbox deletion on a best-effort basis. This mismatch can create a data retention/privacy issue: users and operators may believe data is gone when account records may still remain recoverable or active in downstream logic that does not consistently filter soft-deleted rows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to send recipient addresses, subjects, and message bodies to a third-party email API but does not explicitly warn that this transmits potentially sensitive content off-platform. In an agent skill context, lack of a disclosure/consent warning increases the risk that users or downstream agents send private data without understanding it leaves the local environment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The base URL advertises an unencrypted local HTTP endpoint without any warning that it is only appropriate for trusted local development. If copied into non-local or containerized/shared-network deployments, API keys and email content could be exposed in transit.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to send email content and recipient addresses to a third-party service but does not explicitly warn that this transmits potentially sensitive data off-platform. In an agent context, this can cause unreviewed disclosure of personal, confidential, or regulated information to an external provider.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The examples recommend storing API keys in a plain local file and environment variables without clearly warning about credential leakage through backups, shell history, process inspection, logs, or multi-user systems. If exposed, the API key can be used to impersonate the agent and send unauthorized email.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The model stores a mailbox password directly in a normal String column, indicating plaintext or reversibly stored credentials in the application database. If the database, ORM logs, backups, or admin tooling are exposed, attackers could recover mailbox credentials and gain access to SMTP/IMAP accounts, enabling message theft, impersonation, and lateral compromise.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The code embeds live SMTP credentials directly in source and uses them to send email programmatically without any disclosure, consent, or secret-handling safeguards. Hardcoded credentials are easily exposed through source control, logs, or artifact leakage, enabling unauthorized mailbox access or abuse of the SMTP account for spam, phishing, or impersonation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script transmits an email over the network using embedded SMTP credentials and does so automatically when executed, with no user warning, consent, or runtime confirmation. In the context of an agent skill, undisclosed outbound network actions combined with credentialed access increase the risk of unauthorized messaging, data exfiltration, and abuse of the associated mailbox.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The file contains a hardcoded SMTP password in plaintext, which is a direct secret exposure vulnerability. Anyone with access to the code can reuse the credential to authenticate to the mail server, send unauthorized email as the account, access related infrastructure depending on credential reuse, or abuse the account for phishing and spam.

External Transmission

Medium

• Category: Data Exfiltration

Content

api_key = data["apiKey"]

# Send email
requests.post(
    "https://api.quiet-mail.com/agents/my-bot/send",
    headers={"Authorization": f"Bearer {api_key}"},
    json={

• Confidence: 95% confidence
• Finding: This duplicate finding is the same send-email HTTPS call already assessed above. It is dangerous in an agent environment because it sends user-provided content externally and could be abused for unauthorized data transmission or spam if not gated by consent and policy checks.

External Transmission

Medium

• Category: Data Exfiltration

Content

api_key = data["apiKey"]

# Send email
requests.post(
    "https://api.quiet-mail.com/agents/my-bot/send",
    headers={"Authorization": f"Bearer {api_key}"},
    json={

• Confidence: 95% confidence
• Finding: This duplicate finding is the same send-email HTTPS call already assessed above. It is dangerous in an agent environment because it sends user-provided content externally and could be abused for unauthorized data transmission or spam if not gated by consent and policy checks.

External Transmission

Medium

• Category: Data Exfiltration

Content

const {apiKey} = await createResp.json();

// Send email
await fetch('https://api.quiet-mail.com/agents/my-bot/send', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,

• Confidence: 94% confidence
• Finding: This duplicate URL-only finding points to the send-email endpoint already assessed. In context, the endpoint enables outbound transmission of user content and therefore warrants consent and privacy warnings.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Send email
requests.post(
    "https://api.quiet-mail.com/agents/my-bot/send",
    headers={"Authorization": f"Bearer {api_key}"},
    json={
        "to": "[e-mail]",

• Confidence: 94% confidence
• Finding: This finding flags the HTTPS endpoint literal used in the send-email example. The risk is not the URL itself but that the documented flow sends message content and recipient addresses to an external provider, which can expose user data if used without consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

const {apiKey} = await createResp.json();

// Send email
await fetch('https://api.quiet-mail.com/agents/my-bot/send', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,

• Confidence: 94% confidence
• Finding: This duplicate URL-only finding points to the send-email endpoint already assessed. In context, the endpoint enables outbound transmission of user content and therefore warrants consent and privacy warnings.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Base URL:** `https://api.quiet-mail.com` (or `http://127.0.0.1:8000` for local)

**Philosophy:** Simple, unlimited email for AI agents. No verification required.

---

• Confidence: 91% confidence
• Finding: Advertising 'Simple, unlimited email for AI agents. No verification required.' signals a service design that lowers friction for autonomous outbound messaging with minimal identity controls. In context, that materially increases abuse potential for spam, phishing, and unauthorized messaging from agent workflows.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Agent creation
- Email sending
- Sent email tracking
- No verification required
- Unlimited sending (monitored)

• Confidence: 90% confidence
• Finding: The changelog reiterates that the service supports email sending with no verification required, reinforcing a weak-control model for autonomous communications. In a skill for AI agents, this increases the likelihood of misuse at scale and makes the overall integration more dangerous than a typical mail API.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# quiet-mail API

Unlimited email for AI agents. No verification, no limits, just reliable email.

## Features

• Confidence: 91% confidence
• Finding: Advertising 'Unlimited email for AI agents' with 'No verification, no limits' indicates a service deliberately designed to remove identity and abuse controls from a high-risk capability. In the context of email sending, this materially increases the likelihood of spam, phishing, account farming, and other anonymous misuse at scale.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Features

- ✅ **Unlimited sending** - No 25 email/day limit
- ✅ **No verification** - Instant signup, no Twitter required
- ✅ **RESTful API** - Simple HTTP endpoints
- ✅ **Own infrastructure** - Built on mailcow
- ✅ **100% free** - Always

• Confidence: 93% confidence
• Finding: The feature list explicitly promotes 'Unlimited sending' and 'No verification,' which lowers barriers for automated abuse of outbound email infrastructure. In this skill context, the combination is especially dangerous because it enables anonymous, scalable messaging by AI agents without meaningful accountability.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

{
  "name": "quietmail",
  "version": "1.0.0",
  "description": "Unlimited email for AI agents. No verification, no limits, just reliable email.",
  "keywords": [
    "email",
    "ai",

• Confidence: 88% confidence
• Finding: The package description explicitly advertises 'No verification' and 'no limits' for email sending by AI agents. In the context of an email-sending skill, this materially lowers abuse barriers and can enable spam, phishing, account impersonation, and automated malicious outreach at scale.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"api_base": "https://api.quiet-mail.com",
      "features": [
        "Unlimited sending",
        "No verification required",
        "1GB storage per agent",
        "Simple REST API",
        "Free forever"

• Confidence: 91% confidence
• Finding: The feature list repeats 'No verification required' alongside 'Unlimited sending,' reinforcing that the service is designed to permit unverified autonomous email use. Within an AI-agent-focused mail skill, this combination significantly increases the likelihood of mass unsolicited email, phishing campaigns, and other automated abuse.

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key(agent_id):
    """Get API key from database"""
    conn = psycopg2.connect(DB_CONN)
    cur = conn.cursor()
    cur.execute('SELECT api_key FROM agents WHERE id = %s', (agent_id,))

• Confidence: 93% confidence
• Finding: The test code directly connects to the database using hardcoded credentials and retrieves agent API keys from the agents table. This bypasses normal authentication boundaries and exposes secrets to anyone who can run or read the test, making credential theft and unauthorized API access much easier if the file is reused outside an isolated test environment.

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The requirements pin FastAPI to 0.109.0, which is flagged with a known security advisory. Because this is a web API framework and the dependency is directly used at the application boundary, a vulnerable version increases exposure to remote exploitation or denial-of-service through normal HTTP request handling.

Known Vulnerable Dependency: python-multipart==0.0.6 — 10 advisory(ies): CVE-2024-24762 (python-multipart vulnerable to Content-Type Header ReDoS); CVE-2024-53981 (Denial of service (DoS) via deformation `multipart/form-data` boundary); CVE-2026-53539 (python-multipart: Quadratic-time querystring parsing with semicolon separators c) +7 more

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: python-multipart==0.0.6 has multiple multipart parsing advisories, including ReDoS and malformed boundary-driven denial-of-service issues. In a FastAPI application, multipart parsing is commonly exposed through file upload or form endpoints, so an attacker may be able to trigger excessive CPU or resource consumption with crafted requests.

Known Vulnerable Dependency: aiosmtplib==3.0.1 — 1 advisory(ies): CVE-2026-53533 (aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient ad)

Low

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: aiosmtplib==3.0.1 is reported as vulnerable to SMTP command injection via CR/LF in email address fields. This becomes exploitable if untrusted sender or recipient values are passed into SMTP operations without strict validation, potentially allowing manipulation of SMTP commands or message routing.

Known Vulnerable Dependency: python-jose==3.3.0 — 5 advisory(ies): CVE-2024-33663 (python-jose algorithm confusion with OpenSSH ECDSA keys); CVE-2024-33664 (python-jose denial of service via compressed JWE content); CVE-2024-33663 (python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and ot) +2 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: python-jose==3.3.0 is associated with multiple serious JWT/JWE issues, including algorithm confusion and denial-of-service conditions. Since this package is explicitly under the authentication and security section, any flaw in token verification or cryptographic handling can directly undermine authentication, permit token forgery under some configurations, or allow attackers to disrupt auth processing.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.