Email MCP Helper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.2

Overview

This is a powerful email-control skill whose purpose is clear, but its documented endpoint and deployment guidance are not scoped tightly enough for mailbox credentials and mutating email actions.

Review before installing. Only use this skill with an MCP endpoint you control or have independently verified, rotate and scope API keys, pin the email MCP image and proxy to audited immutable versions, and require explicit user confirmation before sending, forwarding, bulk-moving, deleting, or permanently deleting email.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skills.md:31

Finding

Hardcoded Unverified MCP Endpoint Receives Privileged Email Requests and API Credentials

Content

View full analysis

Vulnerability Details

File Location: skills.md:31-33
Vulnerability Type: Hardcoded unverified external service endpoint
Risk Level: High

Vulnerable Code Snippet

markdown

| URL | `https://mcp-server-addres.com/mcp` |
| Transport | SSE |
| Auth | API key via `X-API-Key` header (managed by infrastructure) |

Technical Analysis

The skill documents a fixed MCP endpoint while describing an API key transmitted through the X-API-Key header. The endpoint is not tied to a user-configured trusted host, and the skill provides no endpoint allowlisting, certificate-pinning guidance, ownership verification, or other trust validation.

The MCP service has extensive mailbox capabilities, including reading messages and attachments, extracting contacts, sending and forwarding email, and deleting or moving messages. Consequently, an operator controlling the configured endpoint could receive the API credential and observe or manipulate privileged email operations.

Exploitation is conditional on a user deploying the skill with this endpoint and supplying a valid API key. The documentation alone does not establish that the domain is malicious, but directing privileged operations and credentials to an unidentified hardcoded host creates a significant trust-boundary risk.

Attack Path

1. A user configures the skill using the hardcoded endpoint in skills.md.
2. The email client or MCP integration connects to https://mcp-server-addres.com/mcp.
3. The integration sends its API key in the X-API-Key request header.
4. An operator controlling the endpoint receives the credential and privileged MCP requests.
5. The operator can return manipulated tool responses or use the exposed service access to read mailbox data and perform supported email actions, subject to the permissions granted to the API key and backend service.

Impact Assessment

A successful exploit may disclose the MCP API key, message contents, email metadata, contact informat ...[truncated 397 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the hardcoded MCP URL and require administrators to provide the endpoint through an explicit deployment configuration value.
• Validate the configured hostname against a trusted-host allowlist before transmitting credentials or mailbox data.
• Require HTTPS with strict certificate and hostname verification; consider certificate pinning for controlled deployments.
• Scope API keys to the minimum required accounts and operations, and use separate credentials for read-only and mutating actions.
• Prevent credentials from being sent across redirects or to hosts other than the configured trusted endpoint.
• Store API keys in a dedicated secret manager rather than in skill files, command-line arguments, or general configuration files.
• Document endpoint ownership verification, key rotation, revocation, and audit logging procedures.
• Require explicit user confirmation for externally visible or destructive operations such as sending, forwarding, bulk deletion, and permanent deletion.

T08 · Insecure Dependencies

Error

• Location: skills.md:18

Finding

Mutable and Unpinned Email MCP Deployment Dependencies

Content

View full analysis

Vulnerability Details

File Location: skills.md:18-19
Vulnerability Type: Unpinned third-party container and proxy dependencies
Risk Level: High

Vulnerable Code Snippet

markdown

- The `email-mcp` image (`ghcr.io/codefuturist/email-mcp:latest`) is stdio-only — it has no built-in HTTP server
- A **MCP proxy** (e.g. `sparfenyuk/mcp-proxy`) must be installed alongside it to expose the server over HTTP/SSE — without the proxy the server cannot be reached over a network

Technical Analysis

The deployment guidance references the mutable latest tag for the email MCP container and names an MCP proxy without specifying an audited version or immutable artifact digest. Mutable tags can resolve to different image contents over time, meaning the code installed by a user may differ from the version previously reviewed.

The proxy is also part of the security boundary because it exposes the stdio-based MCP server over HTTP/SSE. A compromised or unexpectedly changed server image or proxy can process API credentials, access mounted email configuration, observe mailbox content, and alter tool requests or responses.

No malicious dependency is present in the audited project itself, and exploitation depends on a compromised or unsafe upstream release. Nevertheless, the documented installation method does not provide reproducible or integrity-verified deployment.

Attack Path

1. An attacker compromises an upstream image, package, maintainer account, registry account, or release pipeline.
2. The attacker publishes modified content under the mutable latest tag or an otherwise unpinned proxy release.
3. A user follows the skill documentation and builds or updates the deployment without verifying a digest, signature, or locked version.
4. The compromised component starts with access to the mounted config.toml, network connectivity, and email-service credentials.
5. The component captures credentials or mailbox data, modifies MCP traffic, perf ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every container image by immutable digest, for example image@sha256:..., rather than using latest.
• Pin the MCP proxy to a specific audited version and immutable digest.
• Maintain a lock file or deployment manifest recording all exact dependency versions and digests.
• Verify image signatures or provenance attestations before deployment, and enforce verification in CI/CD.
• Generate and review a software bill of materials for both the MCP server and proxy.
• Use automated vulnerability scanning, but require controlled review before updating pinned artifacts.
• Run the containers as non-root with a read-only filesystem, dropped Linux capabilities, resource limits, and a restrictive seccomp or equivalent runtime profile.
• Mount email configuration and secrets read-only and expose only the minimum credentials required by each deployment.
• Restrict outbound network access to approved IMAP, SMTP, and administrative destinations to reduce exfiltration opportunities.
• Place the proxy behind authenticated TLS termination and limit access through network policy or firewall rules.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.