ClawHub
Back to skill

Security audit

Offer-Rain

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it asks users to save reusable email credentials in plaintext and copies them into multiple local job-application files.

Review before installing. Use a dedicated app password or authorization code with limited scope, avoid committing or syncing user.json or log files, delete generated configs after sending, and rotate the email authorization code if it has already been stored in shared or backed-up directories.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:48
Finding

Plaintext SMTP Credential Persistence and Duplication

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:48-54; related credential duplication instructions appear at SKILL.md:91-93 and SKILL.md:109-113
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code Snippet

json
{
    "smtp_server": "smtp.163.com",
    "smtp_port": 465,
    "sender": "your_email@163.com",
    "password": "your_email_password",
    "attachment_path": "path/to/your/resume.pdf"
}

The Skill additionally instructs the agent to inherit the SMTP server, port, sender, password, and attachment path from the user configuration into each per-application email configuration. The corresponding per-application example also includes the plaintext password:

json
{
    "receiver": "recruiter@company.com",
    "subject": "XXX-University-Senior",
    "body": "Hello, I am XXX. Please find my resume attached. Thank you.",
    "smtp_server": "smtp.163.com",
    "smtp_port": 465,
    "sender": "your_email@163.com",
    "password": "your_email_password",
    "attachment_path": "path/to/your/resume.pdf",
    "attachment_name": "XXX-University-Senior"
}

Technical Analysis

The workflow requires the user's SMTP authorization code to be written as plaintext into user.json. It then directs the agent to copy that credential into every job-specific JSON file under ./log/YYYY-MM-DD/.

This violates secret-management and data-minimization principles. Instead of limiting the authorization code to the SMTP authentication operation, the design creates multiple persistent copies alongside personal information and recruitment records. The project provides no requirement for restrictive file permissions, encryption, operating-system credential storage, automatic deletion, log redaction, or source-control exclusions.

Although scripts/send_email.py uses SMTP_SSL, which protects the credential while it is transmitted to the SMTP ser ...[truncated 1578 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the password field from user.json, job-specific configuration files, examples, and generated logs.
  2. Retrieve the SMTP authorization code only at execution time from one of the following:
    • An operating-system credential manager.
    • A dedicated secret-management service.
    • A protected environment variable.
    • A non-echoing interactive prompt.
  3. Pass the secret to the SMTP client in memory and avoid writing it to disk or displaying it in command output.
  4. Keep job-specific configuration files limited to non-secret fields such as the recipient, subject, body, attachment path, and attachment display name.
  5. Add user.json, log/, and other generated credential-bearing files to source-control ignore rules as defense in depth.
  6. Create generated files with owner-only permissions where supported, such as mode 0600 on POSIX systems.
  7. Define a retention policy and automatically delete obsolete application configurations.
  8. Scan existing project copies, repositories, backups, and synchronized folders for previously generated credentials.
  9. Revoke and rotate any SMTP authorization code that may already have been persisted or exposed.
  10. Ensure error messages and diagnostic logging never print SMTP authorization codes or complete configuration objects.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instructions operationalize collection, storage, and reuse of highly sensitive email secrets in ordinary workflow steps, normalizing insecure handling of authentication material. In this context, the secret directly enables outbound email access, so compromise could lead to account abuse, phishing, and loss of mailbox confidentiality depending on the provider's permissions.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The workflow requires duplicating the user's SMTP credentials into multiple per-application config files stored in log directories, greatly increasing credential sprawl. In a job-application context, this is especially dangerous because the system may accumulate many dated files over time, broadening the chance of exposure through backup sync, debugging artifacts, or user error.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
78% confidence
Finding

The skill performs file access operations such as reading and creating user.json and per-recipient config files, but it does not declare an explicit tool scope or permissions boundary. This increases the risk of unintended file access and makes the skill harder to govern or sandbox safely, especially because it handles sensitive local data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill tells the user to place an email authorization code/password into a local JSON file without any warning about plaintext credential storage, theft risk, or safer alternatives. That omission undermines informed consent and makes it more likely users will expose sensitive secrets unnecessarily.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow explicitly asks the user for an email authorization code/password and stores it in user.json, a local plaintext file. Storing reusable credentials in plaintext creates a high risk of credential theft from local compromise, backups, logs, or accidental disclosure, and the credential can be reused to send email as the user.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs copying sender credentials from user.json into each per-recipient JSON file under dated log directories. Credential duplication multiplies exposure surfaces, making compromise, accidental sharing, and forensic leakage much more likely across multiple files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow writes recipient email addresses, subjects, bodies, attachment names, and resume paths into local dated files, but does not warn the user that these application records will be persisted. While less severe than credential storage, this can still expose private job-search activity and personal information if the system or logs are accessed by others.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This file contains natural-language comments and command-line help in Chinese, while other user-facing strings such as the parser description and some error text are in English. Because the skill does not provide any language or locale selection or explain that it is intended for a specific language audience, it implicitly enforces mixed locale behavior that may violate language-choice policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.