ProtonMail

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:06 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for reading ProtonMail, but its setup and credential handling create review-worthy risk around private email access.

Review before installing. Prefer an official Proton Bridge setup when possible, pin any Docker image or source revision, bind bridge ports to 127.0.0.1 only, avoid remote plaintext IMAP, and protect or avoid plaintext credential files with restrictive permissions such as 0600. Expect email headers and message bodies to be printed in the terminal when commands are run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: protonmail.py:77

Finding

Plaintext IMAP exposes bridge credentials and mailbox data in the ProtonMail CLI

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: daily-scan.py:146

Finding

Daily scanner transmits credentials and email metadata over plaintext IMAP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: protonmail.py:135

Finding

Unescaped search input permits IMAP search-criteria injection

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Setup executes an unpinned third-party ProtonMail Bridge container

Content

View full analysis

Remediation

View remediation

`. - Record the corresponding source revision and verify image provenance or signatures before use. - Establish an explicit review and update process instead of automatically following a mutable image reference. - Prefer an officially maintained Proton Bridge distribution where operationally possible. - Bind published ports to loopback: ```bash -p 127.0.0.1:143:143 -p 127.0.0.1:1025:25 ``` - Apply container hardening where compatible: drop unnecessary Linux capabilities, use a read-only filesystem where possible, limit resources, and avoid mounting host paths. - Review the image before enabling the persistent restart policy, and protect the Docker volume as credential-bearing sensitive storage. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Most of the declared purpose matches the code: it does read, search, and scan ProtonMail via an IMAP bridge. However, the description specifically claims 'Includes daily digest for important emails,' which is not implemented anywhere in the supplied code. There is no scheduler, digest generation, importance classification, summarization, or trigger-based automation. The code only provides interactive CLI commands for mailbox listing, inbox viewing, unread listing, search, and reading individual messages. This is a material description-to-behavior mismatch because a named user-facing capability is absent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documentation describes capabilities that access environment variables, local files, and networked email services, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the risk of overbroad execution and unintended access to sensitive mail content or local credential files because consumers cannot easily constrain what the skill may use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The Docker instructions reference the image by name without a fixed tag or digest, so users may pull different or compromised image versions over time. For a mail-access bridge that handles account credentials and message contents, supply-chain drift or image takeover could expose highly sensitive data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The interactive initialization step also uses an unpinned Docker image, which is especially risky because it is the step where users enter Proton credentials and obtain the bridge password. If the image changes or is malicious, credentials could be harvested during setup.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The configuration guidance creates persistent local storage for sensitive connection details under the user's home directory. Persistent session or credential artifacts are more dangerous in this context because the skill accesses private email, so local compromise, backups, or accidental sharing can expose long-lived mailbox access.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Configuration

Create config file at ~/.config/protonmail-bridge/config.env:

bash

PROTONMAIL_HOST=127.0.0.1

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to store a ProtonMail bridge password in a local config file or environment variables without guidance on file permissions, secret storage, or process-environment exposure. Because this credential grants access to mailbox contents, careless storage can lead to credential theft through local compromise, backups, logs, or other tools reading the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code accesses sensitive authentication material from both environment variables and local files, including a bridge password, but only documents the configuration mechanism rather than warning the user that stored credentials will be read. Under SQP-2 for code files, sensitive credential access should have some visible disclosure unless clearly covered as a warned behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · protonmail.py (reported line 85)May include surrounding context.

python

if not CONFIG['user'] or not CONFIG['password']:
        raise ValueError(
            "Missing credentials. Set PROTONMAIL_USER and PROTONMAIL_PASS "
            "environment variables or create ~/.config/protonmail-bridge/config.env"
        )
    
    imap = imaplib.IMAP4(CONFIG['host'], CONFIG['port'])

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code retrieves inbox metadata, search results, unread message headers, and full message bodies from an IMAP account, then prints them directly to stdout. While the behavior is core to the tool, there is no explicit user disclosure in the CLI help or command output warning that sensitive personal email data will be displayed in the terminal.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

shenxn/protonmail-bridge

Initial login (interactive)

docker run --rm -it -v protonmail:/root shenxn/protonmail-bridge init

Then: login → enter credentials → info (shows bridge password) → exit

text

Static analysis

No suspicious patterns detected.