Security audit

BaseMail

Security checks for vulnerabilities and agentic risk

Overview

BaseMail is mostly coherent with its stated email-agent purpose, but it asks for wallet signing authority and signs a server-provided authentication message without locally validating its SIWE scope.

Review before installing if you would use a wallet that controls funds, important identity, or other services. Prefer a dedicated low-value wallet for this skill, understand that ~/.basemail/token.json contains reusable authentication material, and treat inbox content as untrusted external text.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/register.js:211
Finding: Unvalidated Server-Controlled Authentication Message Is Signed by the Wallet
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/inbox.js:45
Finding: Untrusted Email Content Is Written to the Terminal Without Control-Sequence Sanitization
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose is email identity and messaging, but the skill also generates wallets, handles private keys, displays mnemonics, stores refresh tokens, and manages local security material under ~/.basemail. That broader behavior materially increases risk because operators may grant access expecting an email client, while the skill actually performs key management for an onchain identity and persists authentication artifacts.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
node scripts/register.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
node scripts/register.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
node scripts/register.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
node scripts/register.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
node scripts/register.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
node scripts/register.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.
md
node scripts/register.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
node scripts/send.js "friend@basemail.ai" "Hello!" "Nice to meet you 🦞"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
node scripts/send.js "friend@basemail.ai" "Hello!" "Nice to meet you 🦞"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
md
node scripts/send.js "friend@basemail.ai" "Hello!" "Nice to meet you 🦞"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
md
node scripts/inbox.js # List emails

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
node scripts/inbox.js # List emails

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
node scripts/inbox.js # List emails

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
md
node scripts/inbox.js # List emails

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
| `audit.js` | View audit log | ❌ |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill documents capabilities that access environment secrets and make outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope declarations reduce transparency and can let a skill obtain sensitive credentials or exfiltrate data through network access with weaker policy enforcement.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
text
~/.basemail/ ├── private-key.enc # Encrypted private key (AES-256-GCM, chmod 600) ├── wallet.json # Wallet info (public address only) ├── token.json # Auth token + refresh_token + expires_at (chmod 600) └── audit.log # Operation log (no sensitive data)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
text
~/.basemail/ ├── private-key.enc # Encrypted private key (AES-256-GCM, chmod 600) ├── wallet.json # Wallet info (public address only) ├── token.json # Auth token + refresh_token + expires_at (chmod 600) └── audit.log # Operation log (no sensitive data)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
md
| `/api/inbox` | GET | List inbox | | `/api/inbox/:id` | GET | Read email content | **Full docs**: https://api.basemail.ai/api/docs ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
| `/api/inbox` | GET | List inbox | | `/api/inbox/:id` | GET | Read email content | **Full docs**: https://api.basemail.ai/api/docs ---

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-facing console messages at L135 and L139-L149 are written only in Traditional Chinese. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not shown here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Multiple user-facing messages are fixed in Chinese, including errors and inbox/email display text. This can violate a language/locale policy when the skill does not provide user opt-in, selection, or justification for enforcing a single language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code emits multiple required user-facing prompts and error messages only in Traditional Chinese, including validation errors and the password prompt. Because the script does not offer a language option or document that it is intentionally region-specific, it violates the language/locale policy criterion for natural-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The user-facing CLI messages are written in Traditional Chinese, and the script does not provide any option to select another language or locale. This can violate language/locale policy when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/register.js:87

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/token.js:13

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/token.js:31