Inbox Zero API CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:06 AM UTC
• Version: 2.29.2

Overview

The skill looks purpose-aligned for Inbox Zero API work, but it can implicitly invoke an unpinned npm CLI with an API key and modify or delete live mail automation rules without strong confirmation guidance.

Review this skill before installing. Prefer a pinned, reviewed @inbox-zero/api version; use a revocable, least-privilege API key; avoid implicit rule changes; inspect and back up a rule before update or delete; and avoid leaving rule JSON files in shared or synced workspaces.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7
• Finding: Unpinned External npm Package Installation and Execution## Vulnerability Details **File Locations**: - `SKILL.md:7` - `SKILL.md:28` - `references/cli-reference.md:3-8` **Vulnerability Type**: Unpinned third-party dependency and remote package execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:7` ```yaml metadata: { "openclaw": { "skillKey": "inboxZeroApi", "requires": { "bins": ["inbox-zero-api"], "env": ["INBOX_ZERO_API_KEY"] }, "primaryEnv": "INBOX_ZERO_API_KEY", "install": [ { "id": "node", "kind": "node", "package": "@inbox-zero/api", "bins": ["inbox-zero-api"], "label": "Install Inbox Zero API CLI (npm)" } ] } } ``` `SKILL.md:28` ```bash If the CLI is not installed yet, install it with the OpenClaw installer or run `npm install -g @inbox-zero/api`. ``` `references/cli-reference.md:3-8` ```markdown ## Install Use one of: - `npm install -g @inbox-zero/api` - `npx @inbox-zero/api --help` ``` ### Technical Analysis The Skill installs or directly executes `@inbox-zero/api` without specifying an exact version or integrity value. Consequently, npm resolves whichever package version is current under the configured registry at execution time. The reviewed project does not include the package source, a lockfile, a checksum, or a signature that would allow the executed implementation to be verified. Both global npm installation and `npx` can execute package-controlled code, including lifecycle scripts and the CLI entry point. The package is expected to receive `INBOX_ZERO_API_KEY`, making dependency compromise particularly consequential. Although the package name is consistent with the declared Inbox Zero integration and the audit found no evidence that it is currently malicious, the instructions establish an avoidable supply-chain exposure. ### Attack Path 1. An agent follows the Skill instructions and runs `npm install -g @inbox-zero/api` or `npx @inbox-zero/api`. 2. npm resolves an unpinned release from the user's configured registry. 3. ...[truncated 1415 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@inbox-zero/api` to a specific, reviewed version in both Skill metadata and command examples. 2. Prefer a project-local, lockfile-backed installation using `package-lock.json` rather than global installation or unpinned `npx` execution. 3. Use npm integrity metadata and verify the package provenance, publisher identity, registry origin, and release signatures before execution. 4. Configure an explicit trusted npm registry and avoid inheriting arbitrary user-controlled registry configuration in automated environments. 5. Disable package lifecycle scripts during installation where compatible, then invoke only a reviewed CLI entry point. 6. Run the CLI in a restricted environment with minimal filesystem and network access. 7. Supply a narrowly scoped and revocable API key that permits only the Inbox Zero operations required by the task. 8. Ensure custom `INBOX_ZERO_BASE_URL` values are trusted HTTPS endpoints before exposing credentials to them. 9. Document an approved package version and an update-review process so dependency upgrades do not silently change the code executed by the Skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The markdown explicitly says the skill can 'manage automation rules' and 'change Inbox Zero state,' including create, replace, and update flows. While it documents workflow details, it does not clearly warn users that these commands can modify live mailbox automation and that updates may have production impact, which is the kind of user-data/system-integrity warning expected for markdown skill descriptions.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. Prefer `--json` so the output is stable and machine-readable.
2. Keep credentials in `INBOX_ZERO_API_KEY` or OpenClaw skill config. Avoid passing API keys as CLI flags unless there is no alternative.
3. Before creating or replacing a rule body, fetch the live schema with `inbox-zero-api openapi --json`.
4. For create and update flows, write JSON into a workspace file or pipe it on stdin.
5. Treat `rules update` as a full replacement. Read the current rule first if you only intend to change part of it.

## Quick Start

• Confidence: 79% confidence
• Finding: The instruction to write create/update JSON into a workspace file can leave sensitive rule definitions or operational data persisted on disk longer than necessary. In shared, synced, or less isolated workspaces, those files may be exposed to other processes, users, backups, or later agent steps, increasing the chance of unintended disclosure or reuse.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation without any trigger constraints, so the agent may call this CLI whenever a prompt loosely relates to inbox rules, analytics, or automation. Because this skill can inspect live API schema and manage automation rules, overly broad auto-invocation increases the chance of unintended API access or state-changing actions from ambiguous user input.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The documentation recommends running `npx @inbox-zero/api` without pinning a specific version, which causes execution of whatever package version is current at invocation time. This creates a supply-chain risk: a malicious or compromised newly published version could be fetched and executed unexpectedly, and the skill context makes that more sensitive because the CLI can access API keys and manage live automation rules.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The reference includes a `rules delete` command with no explicit warning, confirmation guidance, or rollback note, which increases the chance of accidental destructive actions. In this skill's context, deletion affects live automation rules, so a mistaken command could disrupt inbox processing or business workflows even if no attacker is involved.

Static analysis

No suspicious patterns detected.