ClawHub
Back to skill

Security audit

dropmail

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent disposable-email CLI that clearly discloses its third-party email service use and local mailbox/session storage, with only ordinary privacy and installation cautions.

Install it only if you are comfortable routing disposable-email traffic through GuerrillaMail and storing received messages plus mailbox session cookies under ~/.dropmail/. Do not use it for sensitive account recovery, financial, medical, or long-lived login flows, and prefer the user-local install unless you specifically need a system-wide command.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared purpose is an end-user feature for managing disposable email addresses via GuerrillaMail. The actual code does not create temp emails, interact with GuerrillaMail, fetch inboxes, or implement any email-management workflow. Instead, it contains security-focused unit tests for sanitizing attacker-controlled text rendered in a terminal. While such sanitization could be a supporting detail inside an email-reading tool, this specific chunk’s primary behavior is testing text-cleaning logic, not disposable email management. Therefore the code chunk does not accurately represent the declared skill description.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
"}

# Dangerous format (Cf) characters that are not caught by a "strip all Cc"
# rule because Unicode classes them as Cf, not Cc. Left-to-right / right-to-left
# overrides, embeddings, and isolates let a crafted message reorder how the
# terminal renders text (bidi spoofing, e.g. hiding a trailing command).
_BIDI = {
    "‎", "‏",                          # LRM / RLM
    "‪", "‫", "‬", "‭", "‮",  # LRE RLE PDF LRO RLO
    "⁦", "⁧", "⁨", "⁩",       # LRI RLI FSI PDI
}


def _valid_email(email: str) -> bool:
    return bool(email) and len(email) <= 254 and bool(_EMAIL_RE.match(email))


def _clean(text) -> str:
    """Strip terminal control/escape characters from server-supplied content.

    Inbox contents come from anyone who emails a disposable address, i.e. they
    are fully attacker-controlled. Printing them raw would let a crafted message
    inject escape sequences into the user's terminal (ANSI/OSC screen spoofing,
    clipboard/title manipulation) or reord
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: dropmail
description: Manage disposable email addresses using GuerrillaMail. Use when a user wants to create a temporary/throwaway email address, check a disposable inbox for messages, or avoid sharing their real email with untrusted services. Triggers on phrases like "temp email", "disposable email", "temporary email", "throwaway email", "create a burner email", or any dropmail command.
---

# DropMail Skill
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
For markdown files, SQP-2 applies when the skill description omits warnings about behaviors affecting user data or privacy. The README states that the skill creates disposable addresses via the GuerrillaMail API and stores mail locally, but it does not clearly disclose the privacy implication that emails and related session data are handled by an external provider.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# System-wide: install a root-owned COPY (not a symlink). A symlink from a
# root PATH into the skill directory would run whatever later lands there;
# a copy owned by root:root can only be changed by root.
sudo install -o root -g root -m 0755 <skill-dir>/scripts/dropmail.py /usr/local/bin/dropmail

# User-local: a symlink is fine here — ~/.local/bin and the skill directory
# are both controlled by the same (non-root) user.
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# System-wide: install a root-owned COPY (not a symlink). A symlink from a
# root PATH into the skill directory would run whatever later lands there;
# a copy owned by root:root can only be changed by root.
sudo install -o root -g root -m 0755 <skill-dir>/scripts/dropmail.py /usr/local/bin/dropmail

# User-local: a symlink is fine here — ~/.local/bin and the skill directory
# are both controlled by the same (non-root) user.
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill metadata does not declare an explicit tool/permission scope, while the documented behavior clearly includes network access and local file writes, and also contradicts itself on environment-variable access. Missing scope declarations weaken reviewability and can let a caller invoke a skill with broader authority than users expect. The context makes this somewhat more concerning because the skill handles mailbox contents and session cookies, which are sensitive even if disposable.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: dropmail
description: Manage disposable email addresses using GuerrillaMail. Use when a user wants to create a temporary/throwaway email address, check a disposable inbox for messages, or avoid sharing their real email with untrusted services. Triggers on the phrases "temp email", "disposable email", "temporary email", "throwaway email", or "create a burner email".
---

# DropMail Skill
Confidence
88% confidence
Finding
The skill persists mailbox state and session cookies on disk, enabling continued access to disposable inboxes beyond a single invocation. If those local artifacts are exposed through backup leakage, local compromise, or misconfigured permissions, an attacker could read cached messages or hijack mailbox sessions. The context increases sensitivity because disposable inboxes commonly receive one-time codes and login links.

External Transmission

Medium
Category
Data Exfiltration
Content
Declared so its authority is reviewable before you run it — it does exactly this and no more:

- **Network:** HTTPS requests to `https://api.guerrillamail.com/ajax.php` only. No other host is contacted.
- **Filesystem:** reads and writes only under `~/.dropmail/` (the SQLite DB and `sessions.json`). Nothing else on disk is read or written.
- **No shell execution, no environment-variable reads, no credentials.** The skill runs no subprocesses and needs no API keys or secrets.
Confidence
84% confidence
Finding
The skill transmits email data to an external third-party service, GuerrillaMail, including mailbox contents, subjects, senders, and message bodies. This is inherently privacy-sensitive because verification codes, login links, or other sensitive content could be exposed to the provider or intercepted if the external service is compromised. The context makes this more dangerous because the skill is explicitly intended for untrusted-service signups, where users may nonetheless route sensitive account flows through it.

External Transmission

Medium
Category
Data Exfiltration
Content
_SSL_CTX = _make_ssl_context()
API_BASE = "https://api.guerrillamail.com/ajax.php"
SESSION_FILE = DB_DIR / "sessions.json"

# Language sent to the GuerrillaMail API (affects returned welcome/excerpt text).
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
_SSL_CTX = _make_ssl_context()
API_BASE = "https://api.guerrillamail.com/ajax.php"
SESSION_FILE = DB_DIR / "sessions.json"

# Language sent to the GuerrillaMail API (affects returned welcome/excerpt text).
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium
Category
Rogue Agent
Content
# ── Filesystem helpers ────────────────────────────────────────────────────────
def _ensure_private_dir():
    """Create ~/.dropmail owned by the user only (0700). Session cookies and
    cached inbox contents live here; other local users must not read them."""
    DB_DIR.mkdir(parents=True, exist_ok=True)
    try:
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Low
Confidence
97% confidence
Finding
The documentation states there are no environment-variable reads, but later explicitly documents use of DROPMAIL_LANG. This inconsistency can mislead reviewers and users about data sources and runtime behavior, undermining trust in the declared security boundary. The practical impact is limited because the documented variable appears low sensitivity, but the mismatch signals weak security documentation hygiene.

Static analysis

No suspicious patterns detected.