ClawHub
Back to skill

Security audit

BaseMail

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its email-agent purpose, but its managed wallet setup can expose a full wallet recovery phrase in logs, so it should be reviewed before installation.

Install only if you are comfortable giving this skill a dedicated wallet identity and BaseMail email access. Use a wallet with no funds or valuable permissions, avoid managed setup in logged or non-interactive environments unless you accept that the recovery phrase may appear in logs, and protect ~/.basemail/token.json and private-key.enc as secrets.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill explicitly requires environment secrets and documents outbound API usage, yet the static finding indicates no declared permissions are present for those capabilities. This creates a transparency and least-privilege problem: users or orchestrators may approve/run the skill without understanding that it can access sensitive credentials and transmit data to external services.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The script prints the wallet mnemonic phrase in full to stdout, which can be captured by terminal history tools, CI/CD logs, agent orchestration logs, remote consoles, or other monitoring systems. In this skill’s context, the mnemonic is equivalent to full wallet takeover, so exposing it during setup materially increases the chance of irreversible asset theft and account compromise.

Intent-Code Divergence

High
Confidence
93% confidence
Finding
The comments state that the mnemonic will not be output to the terminal, but the code later prints it in full. This mismatch is dangerous because operators and downstream agents may rely on the safety claim and run the script in logged or automated environments, causing secret disclosure they did not expect.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"audit": "node scripts/audit.js"
  },
  "dependencies": {
    "ethers": "^6.16.0"
  },
  "keywords": [
    "basemail",
Confidence
93% confidence
Finding
The dependency uses a caret range (^6.16.0), which allows newer compatible versions to be installed automatically. This can introduce supply-chain risk because future upstream releases may change behavior or include a compromised package version without this skill being explicitly updated or reviewed.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/register.js:87

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/token.js:13

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
scripts/token.js:31