Security audit

Ethermail

Security checks for vulnerabilities and agentic risk

Overview

This skill is aimed at EtherMail access, but it asks users to route wallet authentication through raw private-key signing and loosely scoped browser automation.

Review this carefully before installing. Use a dedicated low-value wallet only, avoid giving raw private keys to third-party scripts, verify any WalletConnect request before signing, and prefer a pinned, reviewed connector or hardware/isolated signer. Do not use the extraction script with arbitrary URLs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract-wc-uri.js:82
Finding: Unrestricted Browser Target Enables Blind Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:78
Finding: Unpinned External WalletConnect Skill Receives a Raw Wallet Private Key and Automatically Signs Requests
Content: View full analysis
" ``` The documented behavior then states: ```text The connector will automatically sign the `personal_sign` request, completing login. ``` ### Technical Analysis The documented workflow installs `walletconnect-agent` by its mutable package name without specifying a reviewed version, immutable artifact digest, or integrity hash. It then exports a raw Ethereum private key and executes code supplied by that external Skill. This creates a high-impact supply-chain trust boundary. Any compromised, replaced, or unexpectedly changed version of the external Skill would execute while the private key is available in the process environment. Such code could read and transmit the key, sign arbitrary messages, or otherwise impersonate the wallet owner. The automatic handling of `personal_sign` also removes a critical confirmation boundary. The workflow does not require the operator to verify the WalletConnect peer, requesting origin, account, chain context, or full message before signing. A malicious or substituted WalletConnect URI could therefore solicit an attacker-controlled signature. Environment variables are preferable to embedding a secret directly in source code, but they do not safely isolate a secret from the process receiving them. All code loaded by `wc-connect.js`, including its dependencies, can access `process.env.PRIVATE_KEY`. ### Attack Path #### Supply-chain compromise path 1. The user follows the documentation and runs: ```bash clawdhub install walletconnect-agent ``` 2. The package name ...[truncated 1765 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims to provide EtherMail access, but its concrete guidance is primarily about extracting a WalletConnect URI from the page’s Shadow DOM and using an external signing workflow to complete login. That mismatch is security-relevant because it normalizes credential-adjacent auth interception behavior and can cause users or agents to run sensitive wallet-connection steps they would not expect from an email-access skill. In this context, harvesting or relaying a WalletConnect URI can enable unauthorized session initiation or phishing-style wallet approval flows if the URI or downstream connector is mishandled.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with a caret range (^21.0.0), which allows npm to install newer minor and patch releases without explicit review. In a security-sensitive skill that automates browser actions for Web3 and WalletConnect flows, unpinned dependencies increase supply-chain risk and make builds non-reproducible, so behavior and exposure can change over time.
Content: Scanner excerpt · package.json (reported line 9)May include surrounding context.
json
"extract-uri": "node scripts/extract-wc-uri.js" }, "dependencies": { "puppeteer": "^21.0.0" }, "keywords": ["ethermail", "web3", "email", "walletconnect", "ai-agent"], "license": "MIT"

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 83% confidence
Finding: The manifest references puppeteer without an exact pinned version, so it is not possible to verify from this file alone whether the installed release includes a version affected by known advisories. Because this skill uses browser automation in a Web3/email context, uncertainty around the exact browser automation package version increases supply-chain and patch-management risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.