ClawHub
Back to skill

Security audit

Email Swipe

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate email-training skill, but it deserves review because it handles real mailbox data, persists sensitive artifacts locally, and can expose an unauthenticated local/LAN UI while offering optional mailbox-changing tools.

Install only if you want an agent to work with real email-training data. Use demo mode first if unsure, do not expose serve-ui.py to untrusted networks, stop the server when done, review ~/.config/email-swipe for retained data, and require explicit approval before any label/folder creation or mail-platform rule changes.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (64)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_cmd(cmd, capture=True):
    """Run a command and return output or None if fails."""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=capture,
Confidence
94% confidence
Finding
The helper executes shell commands with shell=True, which makes any interpolated value part of a shell command line rather than a safe argument list. In this file, gog_path and account-derived values are later embedded into command strings, so a malicious or malformed config value could trigger command injection during environment detection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_cmd(cmd, timeout=30):
    """Run a command and return output."""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,
Confidence
98% confidence
Finding
The code executes a dynamically constructed shell command with shell=True, where command components include configuration- and user-influenced values such as gog_path, account, and limit. If any of those values contain shell metacharacters, an attacker could achieve command injection and execute arbitrary commands on the host.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises no explicit permissions while the documentation directs the agent to use shell commands, local file reads/writes, environment-based configuration, networked APIs, and MCP tooling. This creates a transparency and consent problem: an operator may activate what appears to be a simple UI skill without realizing it can access mailbox data, persist artifacts, and run local services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description frames the skill as a lightweight sample-mail swipe demo, but the body documents substantially broader behavior: real mailbox access, multi-account handling, folder learning, local HTTP APIs, settings persistence, and platform rule creation. This mismatch can mislead users and higher-level agents into granting trust or invoking the skill in contexts where they would not consent to these broader operations.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The UI is not limited to swipe-based training; it also exposes configuration for autonomy levels, unified inbox behavior, routing, and platform rules that shape later agent actions. In a skill advertised as a demo/sample-mail trainer, expanding into policy and future mailbox action configuration increases the chance of users enabling consequential behavior without understanding the scope.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code posts session progress, swipes, and correction notes to backend APIs despite the skill description emphasizing demo/sample-mail scope. This mismatch is dangerous because users may assume purely local/demo interaction while the UI actually persists behavioral data server-side and participates in later compilation/training workflows.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The settings model includes remote reachability exploration and later UI support for LAN/mobile exposure, which is broader than necessary for a local swipe-training interface. Unnecessary network exposure expands the attack surface and can make sensitive inbox-training data reachable from less trusted devices or networks.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The example file explicitly instructs an agent to fetch real emails from the user's inbox and write them into this format, which conflicts with the stated 'demo is sample mail only' boundary. That mismatch can cause downstream agents or integrators to collect and export real mailbox contents without a clearly defined authorization, scope limit, or safety gate.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
Although labeled as an example batch, the comments direct use of real user inbox data, which encourages implementers to treat production email content as acceptable sample input. In a skill centered on email triage and preference training, that raises privacy and data-handling risk because examples often become de facto implementation guidance.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The bootstrap flow explicitly instructs the agent to fetch 30–50 representative real emails, which conflicts with the stated skill metadata that the demo is sample-mail only. This creates a deceptive data-scope mismatch: users or operators may believe they are in a safe demo mode while the workflow actually pulls private inbox content, increasing the risk of unintended collection and exposure of sensitive communications.

Description-Behavior Mismatch

Medium
Confidence
78% confidence
Finding
The flow instructs the agent to build and then implement routing rules in the user's email platform, which is a state-changing action beyond passive triage or training. Even with preview and confirmation language, automating platform rule creation from inferred preferences can misroute, hide, or deprioritize important mail if the learned rules are wrong or the confirmation step is handled loosely.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The README documents optional scripts that fetch Gmail labels, fetch inbox contents including HTML, and create folders, which exceeds the skill's stated sample-mail-only triage scope. This scope expansion is dangerous because operators may run these capabilities and grant real mailbox access without realizing they are outside the default, increasing the chance of unauthorized data collection or mailbox modification.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The compiler persists multiple durable artifacts including policy briefs, calibration data, training packs, analysis summaries, and session completion/history files, which exceeds a narrow demo/sample-mail triage flow and creates unnecessary long-term storage of behavioral and message-derived data. In an email-training context, those artifacts can encode sensitive user preferences, inferred policies, and account-linked metadata that may later be exposed, reused, or processed outside the user's expectations.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The code stores account/session tracking metadata such as sessionId, intakePath, accountId, accountLabel, preferencesPath, and score/history information in persistent completion and history records. For a swipe-based triage trainer, this creates avoidable linkage between a user's identity, account context, and behavioral training data, increasing privacy risk and the blast radius if local files are accessed by other components or users.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill metadata says the feature is a demo using sample mail for triage/training, but this script performs real Gmail label creation against a live mailbox. That capability exceeds the declared purpose and expands the blast radius from passive demo behavior to active mailbox modification, which is dangerous in an agent skill because users may not expect or consent to account changes.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script uses both direct Gmail API access and a CLI fallback to create labels in a user's mailbox, which is a powerful side-effecting capability unrelated to a stated sample-mail swipe demo. Multiple write-capable execution paths increase the chance that mailbox modification occurs even when one control path is unavailable, making the skill more dangerous and harder to reason about.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This code actively searches environment variables and common filesystem locations for Gmail service-account credential files. In the context of a skill advertised as sample-mail/demo-only, credential discovery is unnecessary and expands access to sensitive authentication material that could later be used to access real mailboxes.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill invokes an external `gog` CLI to enumerate configured accounts on the host, which reveals local mailbox identities and environment state unrelated to a sample-only UI demo. This broadens the skill's reach into user configuration and could be chained with other code to target real accounts.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The module supports discovering real mailbox addresses, service-account files, and token-presence state despite the manifest claiming the demo uses sample mail only. That mismatch is dangerous because it normalizes unnecessary access to real account configuration and credentials within a low-trust skill context.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script fetches live Gmail inbox messages, including full HTML/text content, even though the skill description says the demo uses sample mail only. That mismatch is security-relevant because it grants access to real user communications and expands the skill from a local demo into live mailbox data collection without clear justification or disclosure.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code uses service-account credentials and direct Gmail API access with delegated subject impersonation, which is a powerful enterprise mailbox access mechanism unrelated to a simple swipe-triage demo. In this context, it enables broad, non-interactive access to mailbox contents and increases the blast radius if credentials or configuration are misused.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script writes fetched email data, including message bodies and metadata, to local JSON files and also into a UI asset path. Persisting sensitive mailbox content in plaintext local artifacts increases exposure to accidental disclosure, later reuse by other components, and inclusion in logs, backups, or source-controlled directories.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The skill description says the demo is sample mail only, but this script actively connects to a live provider and pulls real inbox messages. That mismatch can bypass user expectations and safety review boundaries, leading to unintended access to sensitive personal or corporate email data.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The skill invokes an external CLI to access mailbox data, expanding the trust boundary to whatever binary is found at the configured path. In this context, external command execution is especially risky because it combines mailbox access with shell invocation, increasing exposure to injection, binary spoofing, and uncontrolled data handling.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill description says the demo uses sample mail only, but this script accesses a real Gmail account and enumerates live labels. That mismatch can mislead users and integrators about the scope of data access, causing unintended exposure of account metadata and violating least-astonishment expectations in a privacy-sensitive email skill.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/email_access_gate.py:28

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/script_imports.py:17