ClawHub
Back to skill

Security audit

medal-email-quote

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it needs review because it automatically handles full customer emails, stores them locally, can send them to an external translation service, and marks messages read.

Use this only with a dedicated inquiry mailbox and least-privilege app password. Disable or explicitly approve third-party translation before processing sensitive customer mail, require SSL/TLS IMAP, keep credentials out of source files, restrict and clean up email_storage, test mark-as-read behavior on a non-production mailbox, and pin reviewed dependency versions before deployment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/translator.py:55
Finding

Customer Email Content Is Sent to a Third-Party Translation Service by Default

Content
View full analysis

Vulnerability Details

File Location: config/config.py:61-67; scripts/translator.py:55-58
Vulnerability Type: Unrestricted disclosure of sensitive email content to an external service
Risk Level: High

Vulnerable Code

config/config.py:61-67:

python
TRANSLATION_CONFIG = {
    'enabled': True,               # Enable auto translation / Whether translation is enabled
    'default_target_lang': 'zh-CN', # Target language
    # Translation engine: 'google_free' (free Google Translate), 'baidu' (Baidu Translate requires API), 'none' (disable)
    'engine': 'google_free',

scripts/translator.py:55-58:

python
        if self.engine == 'google_free' and self.translator:
            try:
                result = self.translator.translate(text, dest=self.target_lang)
                return result.text, True

Technical Analysis

External translation is enabled in the default configuration. When an email is classified as being in a non-target language, its complete body is passed to the googletrans client. This operation sends customer-controlled and potentially confidential correspondence to an external translation provider.

Email inquiries can contain names, email addresses, telephone numbers, delivery addresses, product designs, pricing expectations, order details, or other commercially sensitive information. The implementation performs no redaction, field-level filtering, consent check, data classification, or destination allowlisting before transmission.

Translation is part of the declared functionality, but automatically disclosing complete email bodies to an external provider exceeds the minimum privilege necessary when a local translator, approved enterprise provider, or explicit opt-in could be used. The documentation mentions translation APIs but does not adequately warn that complete customer correspondence may leave the local environment.

Attack Path

  1. Trans ...[truncated 997 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable third-party translation by default:
    python
    'enabled': False,
'engine': 'none',
  2. Require explicit administrator opt-in before sending any email content externally.
  3. Display a clear disclosure identifying the translation provider, data transmitted, purpose, and applicable retention policy.
  4. Redact email addresses, telephone numbers, physical addresses, identifiers, signatures, and other sensitive fields before translation.
  5. Prefer an approved enterprise API with contractual data-processing controls or a locally hosted translation engine.
  6. Add configurable destination allowlisting and prevent fallback to unapproved providers.
  7. Record only minimal audit metadata rather than email content, and never log translated requests or provider responses containing sensitive data.
  8. Add tests confirming that disabled translation causes no external network request.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/email_utils.py:20
Finding

Configuration Allows Mailbox Credentials to Be Sent over Cleartext IMAP

Content
View full analysis

Vulnerability Details

File Location: config/config.py:17-23; scripts/email_utils.py:20-37
Vulnerability Type: Cleartext transmission of authentication credentials and email data
Risk Level: High

Vulnerable Code

config/config.py:17-23:

python
IMAP_CONFIG = {
    'server': 'imap.qq.com',
    'port': 993,                   # IMAP port, 993(SSL), 143(non-SSL)
    'username': 'your-email@example.com',
    'password': 'your-password-or-app-key',
    'use_ssl': True,
}

scripts/email_utils.py:20-37:

python
def connect_to_imap():
    """Connect to IMAP server"""
    conf = config.IMAP_CONFIG
    if conf['use_ssl']:
        conn = imaplib.IMAP4_SSL(conf['server'], conf['port'])
    else:
        conn = imaplib.IMAP4(conf['server'], conf['port'])
    
    # Send IMAP ID information (fixes NetEase 163 "Unsafe Login" issue)
    try:
        conn._command('ID', '("name" "email-quote-automation" "version" "1.0.0" "vendor" "github" "support-email" "admin@example.com")')
        conn.readline()  # consume response
    except Exception:
        pass
    
    conn.login(conf['username'], conf['password'])

Technical Analysis

If use_ssl is set to False, the code creates a plain imaplib.IMAP4 connection and immediately authenticates without invoking or verifying STARTTLS. IMAP authentication on such a connection can expose the username and password or application-specific authorization code to network observers.

The configuration comments explicitly present port 143 as a supported non-SSL option, making this an exposed operational mode rather than an unreachable branch. No validation rejects insecure authentication, and no certificate-protected upgrade is attempted.

Reading email through IMAP is necessary for the declared functionality. Supporting unencrypted mailbox authentication is not necessary and violates least-secure-channel principles.

A

...[truncated 1073 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove support for unauthenticated cleartext IMAP transport.
  2. Require implicit TLS through IMAP4_SSL, or invoke starttls() with a validated SSL context before authentication.
  3. Reject configurations where TLS is disabled:
    python
    if not conf['use_ssl']:
    raise ValueError("TLS is required for IMAP authentication")
  4. Use ssl.create_default_context() and preserve hostname and certificate validation.
  5. Do not provide port 143 as a “non-SSL” example. If port 143 is supported, document it only as STARTTLS-required.
  6. Prefer application-specific credentials with minimum mailbox permissions and revoke them immediately if cleartext operation may have occurred.
  7. Add integration tests that verify no LOGIN command is issued before a secure channel is established.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/email_utils.py:146
Finding

Mailbox Credentials and Archived Customer Emails Are Stored as Unprotected Plaintext Files

Content
View full analysis

Vulnerability Details

File Location: config/config.py:17-23; scripts/email_utils.py:146-186
Vulnerability Type: Insecure storage of credentials and sensitive customer correspondence
Risk Level: Medium

Vulnerable Code

config/config.py:17-23:

python
IMAP_CONFIG = {
    'server': 'imap.qq.com',
    'port': 993,
    'username': 'your-email@example.com',
    'password': 'your-password-or-app-key',
    'use_ssl': True,
}

scripts/email_utils.py:146-186:

python
def ensure_storage_directories():
    """Ensure storage directories exist"""
    conf = config.STORAGE_CONFIG
    base = conf['base_path']
    for folder in [conf['raw_folder'], conf['text_folder'], conf['translated_folder'], conf['quotes_folder']]:
        path = os.path.join(base, folder)
        os.makedirs(path, exist_ok=True)

def generate_filename(prefix=""):
    """Generate filename with timestamp"""
    now = datetime.datetime.now()
    timestamp = now.strftime('%Y%m%d_%H%M%S')
    if prefix:
        return f"{prefix}_{timestamp}"
    return timestamp

def save_raw_email(filename, raw_bytes):
    """Save raw email"""
    path = os.path.join(config.STORAGE_CONFIG['base_path'], config.STORAGE_CONFIG['raw_folder'], filename + '.eml')
    with open(path, 'wb') as f:
        f.write(raw_bytes)
    return path

def save_text_content(filename, text, is_translated=False):
    """Save text content"""
    if is_translated:
        folder = config.STORAGE_CONFIG['translated_folder']
    else:
        folder = config.STORAGE_CONFIG['text_folder']
    path = os.path.join(config.STORAGE_CONFIG['base_path'], folder, filename + '.txt')
    with open(path, 'w', encoding='utf-8') as f:
        f.write(text)
    return path

def save_quote(filename, quote_text):
    """Save generated quotation"""
    path = os.path.join(config.STORAGE_CONFIG['base_path'], config.STORAGE_CONFIG['quotes_f
...[truncated 2473 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove credentials from source configuration and load them from an operating-system secret store, deployment secret manager, or protected environment variables.
  2. Provide a non-secret example configuration and ensure real configuration files are excluded from version control.
  3. Create storage directories with owner-only permissions, such as mode 0700.
  4. Create archive files atomically with owner-only mode 0600, rather than relying on the ambient umask.
  5. Encrypt archived messages at rest using a managed key and document key rotation and recovery procedures.
  6. Implement configurable retention periods and secure deletion procedures.
  7. Store only the minimum data required for quotation generation; make raw-message retention optional.
  8. Replace second-resolution filenames with collision-resistant identifiers such as UUIDs or cryptographically random values.
  9. Use exclusive or atomic creation to prevent silent overwrites.
  10. Add a documented .gitignore policy for credentials and the complete email_storage directory.

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Dependency Installation Uses Unbounded and Unverified Third-Party Packages

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-3; README.md:55-59
Vulnerability Type: Insufficiently constrained software supply chain
Risk Level: Medium

Vulnerable Code

requirements.txt:1-3:

text
pandas>=1.3.0
langdetect>=1.0.9
googletrans==4.0.0-rc1

README.md:55-59:

bash
pip install -r requirements.txt

Technical Analysis

pandas and langdetect specify only minimum versions, allowing future releases to be selected without review. No artifact hashes or lockfile are provided, so package authenticity and reproducibility are not enforced beyond the package index's normal controls.

googletrans is pinned to a release-candidate version. Although exact pinning limits version drift, using a prerelease package for processing confidential email content increases maintenance and reliability risk. Installation with pip may execute package build or installation logic with the privileges of the invoking user.

No evidence demonstrates that these packages are malicious. The confirmed issue is the unsafe and non-reproducible dependency policy, which creates a supply-chain exposure.

Attack Path

  1. An operator follows the documented installation command.
  2. The package resolver selects current versions satisfying the broad lower bounds.
  3. A future compromised, malicious, or unexpectedly incompatible release can be selected automatically.
  4. Package build or installation code executes under the operator's account during installation.
  5. Imported package code subsequently runs whenever the Skill performs language detection, translation, or other dependency-backed operations.

Impact Assessment

A malicious dependency or compromised release could execute code with the privileges of the user installing or running the Skill. That scope may include reading the project configuration, mailbox credentials, archived customer emails, and other files accessible ...[truncated 252 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct and transitive dependency to a reviewed version.
  2. Generate and commit a reproducible lockfile.
  3. Require package hashes, for example through pip --require-hashes.
  4. Replace the release-candidate translation dependency with a maintained stable library or an explicitly approved provider SDK.
  5. Install packages in an isolated virtual environment under a non-privileged account.
  6. Use an approved package mirror or explicitly configured trusted index.
  7. Run dependency vulnerability, provenance, and license scanning in continuous integration.
  8. Establish an update process that reviews changelogs and artifacts before changing pinned versions.
  9. Remove unused dependencies, including pandas if it is not required by the deployed functionality.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README advertises automatic translation but does not disclose that using external translation engines may transmit customer email content to third-party services. Because inquiry emails can contain personal data, designs, pricing, or proprietary business details, this omission can cause unintentional data disclosure outside the organization.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The supplied code does not perform any of the substantive actions described in the declaration. It only defines a package file with a comment, so the actual behavior is effectively no-op/package initialization. This is a material mismatch because the declared primary purpose describes a fully functional ecommerce email processing and quotation automation workflow, while the provided code chunk implements none of those capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a broader email automation skill centered on retrieving and processing customer emails, including language detection/translation and local persistence. The supplied code only implements quotation-related logic: pricing configuration, request parsing via regex/keywords, and quote text generation in Chinese/English. While generating quotation reply drafts aligns partially with the description, the major advertised capabilities around email fetching, periodic execution, translation/language detection, and storage are absent from this code chunk. Therefore, the description does not accurately represent what this specific code actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states that customer emails are stored locally and may be sent to external translation APIs, but it does not warn about privacy, confidentiality, retention, or third-party data exposure. Because customer inquiries often contain personal, commercial, or order-related information, this creates a meaningful risk of data leakage, compliance violations, and unauthorized disclosure.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/email_template.html (reported line 40)May include surrounding context.

html
</style>
</head>
<body>
<!-- 
This is an example HTML template for sending quotation emails.
You can customize this template according to your company branding.
这是一个用于发送报价邮件的HTML模板示例，你可以根据公司品牌需求自定义。

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/email_template.html (reported line 40)May include surrounding context.

html
</style>
</head>
<body>
<!-- 
This is an example HTML template for sending quotation emails.
You can customize this template according to your company branding.
这是一个用于发送报价邮件的HTML模板示例,你可以根据公司品牌需求自定义。

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly promotes automatic storage of raw emails, extracted text, translations, and quotations, but does not warn about handling potentially sensitive customer data or retention risks. In an email-processing skill, this can lead operators to persist personal or confidential business information insecurely or longer than intended, increasing privacy, compliance, and breach exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README's workflow states that emails are automatically marked as read, but it does not warn users about the operational risk of altering mailbox state. This can hide unreviewed customer inquiries from staff, interfere with triage/auditing workflows, and cause missed messages or accountability gaps if the automation misclassifies or partially processes mail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README promotes automated retrieval, translation, local storage, and message state changes for customer emails, but it does not prominently warn that this workflow processes potentially sensitive business and personal data or that third-party translation services may receive email contents. In an email-automation skill, this omission can lead operators to deploy it without adequate consent, retention, or access-control safeguards, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The storage section documents that emails are archived locally in raw .eml, extracted text, translated text, and quote forms, but it frames this as operational detail rather than a clear security warning. Because these copies can preserve full message bodies, headers, and possibly sensitive commercial or personal information, users may underestimate the exposure created by multi-format local retention.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill describes capabilities that require network access and local file writes, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can lead to overbroad execution or unclear consent around mailbox access and local storage, increasing the chance of unauthorized data handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation language is broad enough to invite use for general email handling rather than a tightly scoped quoting workflow. In agent systems, vague triggering can cause the skill to be invoked in contexts involving unrelated or sensitive email content, increasing the chance of unnecessary access to customer communications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The configuration instructions direct users to place IMAP credentials and API settings in a local config file without any warning about secret handling. This encourages insecure secret storage practices, which can lead to credential leakage through source control, backups, shared workspaces, or local filesystem compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The config sets default_target_lang to zh-CN, which imposes a specific locale by default. Under the policy, forcing a language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The comment and code indicate that when an email is translated, the skill unconditionally generates an English quote for the customer by passing lang='en'. This imposes a specific language choice without offering user selection or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code retrieves full unread email contents via IMAP, including headers, body, and raw bytes, and assembles them for downstream use. Although the docstrings describe functionality, there is no user-facing prompt, logging, or explicit warning that potentially sensitive email data is being accessed and processed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The function marks messages as read, which mutates the user mailbox state and can hide unread inquiries from normal user workflows. In an automation context, this can cause loss of visibility, missed handling, and integrity issues if users are not explicitly aware that the agent is changing message state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code writes raw emails, extracted text, translations, and quotes to local disk, which may include sensitive customer data, business information, and metadata. If storage permissions, retention, or disclosure are not controlled, this increases the risk of privacy exposure, unintended persistence, and data leakage from the host system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module description and implementation indicate that non-target-language emails are translated into a preset target language from configuration. This creates a language/locale policy issue because the behavior is imposed automatically rather than offering the user a language preference or explicit opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code sends full email text to an external translation provider via googletrans without any notice, consent, redaction, or data-classification checks in this module. In the context of ecommerce inquiry automation, customer emails commonly contain personal data, pricing details, addresses, or business-sensitive content, so silent transmission to a third party creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file includes both Chinese and English, but the heading and initial navigation present a specific language/locale structure without any explicit statement that users may choose their preferred language. Under the policy, language handling should clearly offer opt-in or choice rather than implicitly privileging one locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file includes a second language section in Chinese, but there is no indication that the user opted into this locale or that the skill is specifically intended for a Chinese-speaking context. Under the language/locale policy rule, forcing or assuming a specific language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The HTML comment contains Chinese text alongside English guidance, which introduces a specific language into the skill artifact without any stated user opt-in or documented locale constraint. Under the policy, forcing or embedding a specific language without choice can be a natural-language locale violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency specifier pandas>=1.3.0 is unpinned, so installs can resolve to different versions over time, reducing build reproducibility and increasing supply-chain risk if a newly released version introduces a vulnerability or breaking behavior. In an email-processing automation skill, this can affect reliability and security of data handling even if it is not an immediately exploitable flaw by itself.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
pandas>=1.3.0
langdetect>=1.0.9
googletrans==4.0.0-rc1

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.