Security audit

Email Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its email-assistant purpose, but it handles powerful mailbox credentials and tokens in persistent plaintext paths in ways users should review before installing.

Install only if you are comfortable giving this skill read/write/send access to your mailbox. Prefer using a dedicated Microsoft app registration, install and verify a working system keyring, keep the email-assistant data directory private and out of backups/repos, avoid the get-token command, and revoke provider tokens or app passwords when you stop using it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/oauth_web.py:255
Finding: OAuth Access and Refresh Tokens Stored in an Unprotected Plaintext File
Content: View full analysis
.token.json`. 4. A local process, another local user with filesystem access, backup collector, or accidentally shared workspace reads the token file. 5. The attacker submits the access token to Microsoft Graph or exchanges the refresh token for a new access token. 6. The attacker exercises the mailbox privileges granted to the shared Azure application. ### Impact Assessment A stolen token may permit: - Reading email and message metadata. - Searching the mailbox. - Modifying message state. - Sending email as the user. - Continuing access through refresh-token exchange. - Accessing any additional data covered by the granted OAuth scopes. The exposure is limited to actors that can obtain the local token file, but the resulting mailbox privileges are ...[truncated 19 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup_wizard.py:192
Finding: QQ and 163 Mailbox Authorization Codes Remain in Plaintext Despite Keyring Availability
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/email_client.py:57
Finding: Credential Retrieval Path Is Broken by an Undefined Module and Inconsistent Key Naming
Content: View full analysis
:smtp`. Passing `key = ":smtp"` to `secure_get(key)` with its default field would instead search for `:smtp:auth`. This defect undermines the advertised secure-storage design and creates operational pressure to retain plaintext JSON credentials. ### Attack Path 1. A user configures a credential in the operating-system keyring. 2. The SMTP or IMAP client invokes `_get_secure()`. 3. Execution reaches `data_dir.secure_get(key)`. 4. Python raises `NameError` before keyring retrieval or JSON fallback occurs. 5. Operators may restore, retain, or manually rely on plaintext credentials to work around the failure. 6. Those plaintext credentials become exposed through the separate local-file risk. This issue is primarily a secure-control failure rather than a direct remote compromise path. ### Impact Assessment ...[truncated 285 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/oauth_manager.py:194
Finding: OAuth Bearer Token Can Be Printed Directly to Standard Output
Content: View full analysis
`. 2. The command refreshes the token if necessary. 3. The current bearer token is printed to standard output. 4. A logging or transcript system records the output. 5. An attacker gains access to that retained output. 6. The attacker sends authenticated requests to Microsoft Graph using the exposed bearer token. ### Impact Assessment The attacker can exercise the delegated permissions represented by the token, potentially including: - Reading email. - Searching messages and folders. - Modifying message state. - Sending email as the account owner. - Reading additional data covered by unnecessary granted scopes. The access tok ...[truncated 124 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/oauth_web.py:42
Finding: OAuth PKCE Verifier and State Are Generated with a Non-Cryptographic PRNG
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/oauth_manager.py:213
Finding: Revocation Response Handling Can Prevent Local Token Deletion and Misreport Success
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: scripts/setup_wizard.py:44
Finding: MailboxSettings.Read Permission Exceeds the Implemented Feature Requirements
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (95)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/auto_reply.py (reported line 174)May include surrounding context.
python
desc = f"切换自动回复规则 {rule_id} 的启用状态" if not confirm_action(desc, sys.argv): print("[CANCELLED] 用户取消操作。") return rules = _load_rules() for r in rules:

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/auto_reply.py (reported line 192)May include surrounding context.
python
desc = f"切换自动回复规则 {rule_id} 的启用状态" if not confirm_action(desc, sys.argv): print("[CANCELLED] 用户取消操作。") return rules = _load_rules() for r in rules:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 16)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 34)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 35)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 43)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 44)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 50)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 72)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 80)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 93)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 94)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 107)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 124)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 125)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 139)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/data_dir.py (reported line 230)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/email_client.py (reported line 61)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/oauth_manager.py (reported line 29)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/oauth_manager.py (reported line 56)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/oauth_manager.py (reported line 242)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/oauth_manager.py (reported line 244)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/oauth_manager.py (reported line 246)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup_wizard.py (reported line 31)May include surrounding context.
python
3. Skill-adjacent fallback (old behavior, not recommended) Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: This line documents fallback to plaintext JSON when keyring is unavailable, which is a real credential-protection weakness. Since the skill manages email accounts and OAuth tokens, storing them unencrypted materially increases risk of account compromise from local disclosure.
Content: Scanner excerpt · scripts/data_dir.py (reported line 17)May include surrounding context.
python
Secure storage: - Uses system keyring (keyring library) for credential encryption - Falls back to plaintext JSON if keyring is unavailable - Cross-platform: Windows Credential Manager, macOS Keychain, Linux Secret Service """

Static analysis

No suspicious patterns detected.