Security audit

faivelo-email

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its email setup purpose, but it includes broad email/DNS control, unpinned setup code execution, and a Drive file-read capability outside the stated purpose.

Install only if you want an agent to help manage Faivelo email and domain setup. Use least-privilege or agent keys, avoid granting drive:read unless you specifically need it, explicitly approve any DNS, alias, mail-send, or delete action, and keep API keys, mailbox passwords, webhook secrets, and .env files out of logs and source control. Prefer a pinned or otherwise verified Faivelo CLI version instead of running an unpinned npx command in sensitive environments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

MCP Config Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · references/mcp.md (reported line 25)May include surrounding context.
md
| claude.ai / Claude Desktop | Settings → Connectors → Add custom connector → paste the URL | | Codex | `codex mcp add faivelo --url https://faivelo.com/api/mcp` | | Gemini CLI | `gemini mcp add --transport http faivelo https://faivelo.com/api/mcp` | | Cursor | `.cursor/mcp.json`: `{ "mcpServers": { "faivelo": { "url": "https://faivelo.com/api/mcp" } } }` | | VS Code | `.vscode/mcp.json`: `{ "servers": { "faivelo": { "type": "http", "url": "https://faivelo.com/api/mcp" } } }` | | Windsurf | `~/.codeium/windsurf/mcp_config.json`: `{ "mcpServers": { "faivelo": { "serverUrl": "https://faivelo.com/api/mcp" } } }` |

MCP Config Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · references/mcp.md (reported line 26)May include surrounding context.
md
| Codex | `codex mcp add faivelo --url https://faivelo.com/api/mcp` | | Gemini CLI | `gemini mcp add --transport http faivelo https://faivelo.com/api/mcp` | | Cursor | `.cursor/mcp.json`: `{ "mcpServers": { "faivelo": { "url": "https://faivelo.com/api/mcp" } } }` | | VS Code | `.vscode/mcp.json`: `{ "servers": { "faivelo": { "type": "http", "url": "https://faivelo.com/api/mcp" } } }` | | Windsurf | `~/.codeium/windsurf/mcp_config.json`: `{ "mcpServers": { "faivelo": { "serverUrl": "https://faivelo.com/api/mcp" } } }` | ## Tools

MCP Config Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · references/mcp.md (reported line 27)May include surrounding context.
md
| Gemini CLI | `gemini mcp add --transport http faivelo https://faivelo.com/api/mcp` | | Cursor | `.cursor/mcp.json`: `{ "mcpServers": { "faivelo": { "url": "https://faivelo.com/api/mcp" } } }` | | VS Code | `.vscode/mcp.json`: `{ "servers": { "faivelo": { "type": "http", "url": "https://faivelo.com/api/mcp" } } }` | | Windsurf | `~/.codeium/windsurf/mcp_config.json`: `{ "mcpServers": { "faivelo": { "serverUrl": "https://faivelo.com/api/mcp" } } }` | ## Tools

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: A DELETE endpoint for DNS records, especially alongside a force flag for mail-critical records, is dangerous when presented without strong guardrails on parameter validation and human approval. In this skill's context, an AI agent could be delegated infrastructure tasks and accidentally or abusively remove MX, SPF, DKIM, or DMARC records, causing major outage or email security degradation.
Content: Scanner excerpt · references/rest-api.md (reported line 60)May include surrounding context.
md
| `GET /domains/{domain}` | One domain | | `GET /domains/{domain}/dns/records` | Live DNS records (where the DNS host is connected) | | `POST /domains/{domain}/dns/records` | Add a record | | `PUT` / `DELETE /domains/{domain}/dns/records/{id}` | Edit / remove; mail-critical records need `force: true` | ## Aliases and usage

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Alias deletion is a destructive operation that can interrupt mail routing, break business workflows, or cause lost inbound messages if invoked incorrectly. In an agent-oriented skill, exposing the endpoint without caution or confirmation increases the risk of accidental deletion from ambiguous user requests or prompt manipulation.
Content: Scanner excerpt · references/rest-api.md (reported line 64)May include surrounding context.
md
## Aliases and usage `GET/POST /aliases`, `DELETE /aliases/{address}`, `GET /usage` (plan and sending quota left). ## Scopes

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: At the manifest level, the skill description advertises npx faivelo init as the setup path without version pinning. This increases the chance that downstream agents or users will mechanically execute the latest registry package, turning normal documentation into a supply-chain risk vector.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill repeatedly instructs users to run npx faivelo without pinning an exact package version. npx resolves and executes the latest published package by default, so a compromised maintainer account, malicious dependency update, or breaking release could cause users to run unreviewed code at install time with the user's local privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This usage directs execution of npx faivelo init <domain> without a version pin. Because npx fetches the latest package at runtime, any supply-chain compromise or unexpected upstream release can execute attacker-controlled code during a highly privileged workflow that also touches DNS and local environment files.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The command example invokes npx faivelo init example.com without constraining the package version. In this skill's context, that is riskier than a generic CLI because the tool may open browser auth flows, manage DNS, and write SMTP/IMAP credentials into .env, so executing a malicious updated package could expose secrets or alter infrastructure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The --no-open example still relies on unpinned npx faivelo, which means the package version is selected at execution time. A malicious or compromised release could execute arbitrary code while users are performing email domain setup, potentially capturing tokens, modifying DNS-related workflows, or tampering with generated configuration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: Referencing npx faivelo status example.com without a fixed version carries the same supply-chain execution risk as the setup command. Even status/check commands can run arbitrary package lifecycle code or embedded logic before performing the expected action.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The npx faivelo dns example.com --zone example is also unpinned, exposing users to execution of whatever package version is current at the time. Because this command concerns DNS configuration output, a malicious package could mislead operators with altered records or exfiltrate domain/account information.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is positioned as an email/domain-management integration, but its MCP tool list also exposes Drive file listing and downloading via drive_list_files and drive_download_file. That broadens accessible data beyond the stated purpose and can enable unnecessary access to unrelated user files if an agent or user grants the connector broad permissions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/rest-api.md (reported line 11)May include surrounding context.
Send an email

bash
curl https://faivelo.com/api/v1/emails \ -H "Authorization: Bearer $FAIVELO_API_KEY" \ -H "Content-Type: application/json" \ -H "Idempotency-Key: welcome-42" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The mailbox creation and password reset endpoints return credentials 'once', but the documentation does not warn that these are highly sensitive secrets that must not be logged, echoed, or stored insecurely. In an AI-agent setting, that omission is risky because agents often summarize outputs or persist tool results, which could expose mailbox credentials and enable full mailbox compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation exposes DNS record modification and deletion capabilities, including mail-critical records, without any explicit safety guidance, confirmation requirements, or warnings about service disruption. In an agent skill context, this increases the chance an automated system could break email delivery, SPF/DKIM/DMARC validation, or inbound routing through an over-broad or misinterpreted action.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

MCP Config Access

MCP Config Access

MCP Config Access

Tool Parameter Abuse

Tool Parameter Abuse

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Context-Inappropriate Capability

External Transmission

Send an email

Missing User Warnings

Missing User Warnings

Static analysis