Email Sender

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:31 PM UTC
• Version: 1.0.2

Overview

This email skill does what it says, but it embeds a real Gmail app password and can email any readable local file with no built-in confirmation or scope limits.

Review before installing. Only use this skill in a tightly controlled environment after revoking and replacing the embedded Gmail app password, moving credentials to a protected secret store, and adding explicit confirmation plus attachment path limits before any email is sent.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: script.py:10
• Finding: Hard-Coded Gmail SMTP Credentials## Vulnerability Details **File Location**: `script.py`, lines 10-14 **Vulnerability Type**: Hard-coded authentication secret **Risk Level**: High ### Vulnerable Code ```python def send_email(to, subject, body, attachment_path=None, from_name="OpenClaw Bot", cc=None): # === SMTP Configuration === SMTP_SERVER = "smtp.gmail.com" # Gmail SMTP server SMTP_PORT = 587 # TLS port SENDER_EMAIL = "[e-mail]" # Sender email SENDER_PASSWORD = "[REDACTED: hard-coded Gmail App Password]" # App password ``` The password value has been redacted from this report to avoid further credential exposure. The project source contains the complete plaintext credential. ### Technical Analysis A Gmail address and corresponding application password are embedded directly in the distributed Python source. Source-level secrets are available to every user, process, archive, repository, build system, or package registry with access to the skill. The credential is subsequently supplied to `server.login`, so it is an operational authentication secret rather than an example or unused configuration value. Transport encryption does not mitigate exposure at rest in the source package. ### Attack Path 1. An attacker downloads the skill package or obtains access to a copy of its source. 2. The attacker opens `script.py` and extracts the Gmail address and application password. 3. The attacker connects directly to Gmail SMTP at `smtp.gmail.com:587`. 4. The attacker authenticates using the exposed credentials. 5. The attacker sends unauthorized email independently of the skill and its intended controls. ### Impact Assessment Successful exploitation permits unauthorized use of the configured Gmail identity for outbound email. This can facilitate spam, phishing, impersonation, account reputation damage, service suspension, and consumption of provider quotas. The precise account scope depends on the p ...[truncated 234 chars]
• Remediation: ## Remediation Suggestions 1. Revoke the exposed Gmail application password immediately and generate a replacement only if the integration remains necessary. 2. Remove all credentials from the source code and package history. 3. Obtain SMTP credentials at runtime from a protected secret manager or narrowly scoped environment variables. 4. Ensure secret values are excluded from logs, exception messages, version control, build artifacts, and published packages. 5. Use a dedicated service account with the minimum required permissions, sending limits, monitoring, and abuse alerts. 6. Add automated secret scanning to pre-commit hooks and CI/CD pipelines. 7. Review Gmail account activity for unauthorized authentication or email sent using the compromised credential.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: script.py:24
• Finding: Unrestricted Local File Exfiltration Through Email Attachments## Vulnerability Details **File Location**: `script.py`, lines 24-39 **Vulnerability Type**: Unrestricted file access and outbound transmission **Risk Level**: High ### Vulnerable Code ```python # Add attachment if provided if attachment_path and os.path.exists(attachment_path): filename = os.path.basename(attachment_path) with open(attachment_path, "rb") as attachment: part = MIMEBase('application', 'octet-stream') part.set_payload(attachment.read()) encoders.encode_base64(part) part.add_header('Content-Disposition', f'attachment; filename="{filename}"') msg.attach(part) # Send email try: server = smtplib.SMTP(SMTP_SERVER, SMTP_PORT) server.starttls() # Upgrade to secure connection server.login(SENDER_EMAIL, SENDER_PASSWORD) server.send_message(msg) ``` ### Technical Analysis The caller controls both `attachment_path` and the destination address. The implementation accepts an absolute path, verifies only that it exists, reads the entire object with the Agent process's privileges, and transmits its contents through email. There is no canonical-path validation, approved-directory restriction, regular-file check, symlink protection, sensitive-path denylist, attachment-size limit, recipient restriction, or explicit user confirmation showing both the local source and external destination. Consequently, anyone able to influence a tool invocation can request any file readable by the hosting process. The skill then acts as a data-exfiltration channel that crosses the local trust boundary. The legitimate attachment feature does not require unrestricted access to the entire filesystem. ### Attack Path 1. An attacker or attacker-controlled instruction causes `send_email` to be invoked. 2. The invocation supplies the absolute path of a sensitive file accessible to the Agent, such ...[truncated 1054 chars]
• Remediation: ## Remediation Suggestions 1. Restrict attachments to a dedicated, user-approved workspace or export directory. 2. Resolve the requested path with `realpath` or `pathlib.Path.resolve()` and verify that the canonical path remains under an approved root. 3. Reject symlinks, device files, sockets, directories, and other non-regular files. 4. Require explicit user confirmation that displays the canonical file path, file size, and complete recipient list before transmission. 5. Apply recipient allowlists or organizational-domain restrictions where appropriate. 6. Deny known sensitive locations and credential-file patterns as defense in depth. 7. Enforce conservative attachment size and file-type limits, and stream approved attachments instead of reading unlimited content into memory. 8. Run the skill under a dedicated low-privilege operating-system account with access only to files intended for attachment. 9. Record auditable metadata for approved transmissions without logging credentials or attachment contents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill enables sending arbitrary email content and file attachments through SMTP/Gmail but does not warn users that data will leave the local environment and be transmitted to a third-party email provider. This creates a real risk of accidental exfiltration of sensitive reports, logs, or files, especially because the usage guidance broadly encourages emailing files on request.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This function can send arbitrary emails and attach arbitrary local files without any user confirmation, approval gate, or recipient/attachment restrictions. In this specific skill, the risk is amplified because the script also embeds valid SMTP credentials, making it immediately usable for spam, phishing, data exfiltration, or unauthorized transmission of sensitive local files.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The tool description grants a high-risk action ('send an email') without stating when it may be used, what approvals are required, or what categories of content are prohibited. In an agent setting, this can enable unsolicited outbound communication, data exfiltration, spam, or phishing if the model decides to invoke the tool based on ambiguous prompts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This tool exposes an external communication channel but does not warn that using it transmits data outside the system, including message body content and any attached file. Because it also accepts an absolute attachment path, the agent could be induced to email sensitive local files to an external recipient without the user appreciating the exfiltration risk.

Static analysis

No suspicious patterns detected.