ClawHub
Back to skill

Security audit

Mails for Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent email-automation helper, but it gives an agent broad mailbox mutation, sending, and webhook-routing powers without enough user-control guidance.

Review before installing if this mailbox may receive important records or account-recovery messages. Use a dedicated low-risk mailbox, restrict who can use the token, require confirmation before deletes or webhook changes, and avoid forwarding verification codes or mailbox contents to untrusted destinations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
84% confidence
Finding

The documented flow normalizes calling DELETE on an email ID immediately after reading inbox content, without any guardrails on which messages may be deleted or whether they should be preserved. In an agent setting, this creates a parameter-abuse and unsafe-action risk: a prompt-influenced or mistaken agent could delete arbitrary mailbox content, including security-relevant messages, attachments, or account-recovery information.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
**Sign up for a service:** Fill form with `$MAILS_MAILBOX` → GET /api/code?timeout=60 → enter the code

**Process inbox:** GET /api/inbox → GET /api/email?id=ID → DELETE /api/email?id=ID

**Reply to an email:** GET /api/email?id=ID → POST /api/send with `in_reply_to` set to the email's `message_id`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill enables outbound email sending and webhook configuration without prominent warnings about privacy, data exfiltration, impersonation risk, or interaction with external systems. Because the skill is specifically designed for autonomous operation and can receive verification codes, these capabilities could be abused to forward sensitive mailbox contents, trigger external actions, or send unauthorized messages from the controlled mailbox.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill exposes a destructive capability to delete emails and attachments but does not warn the agent or operator about data-loss consequences, retention implications, or the need for explicit user confirmation. In an autonomous mailbox-management context, omission of such safeguards can lead to irreversible deletion of important records, verification messages, or evidence needed for audits and account recovery.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.