T09 · Insecure Skill Coding Practices
Error
- Location
scripts/translator.py:42- Finding
Full customer email bodies are transmitted to an external translation service by default
- Content
View full analysis
- Remediation
View remediation
Security audit
email-quote-automation
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent email-quote automation tool, but it handles mailbox credentials and customer email contents with weak privacy and storage controls.
Review this skill carefully before installing. Use a dedicated mailbox with a revocable app password, keep SSL enabled, avoid committing config/config.py after adding secrets, disable external translation unless approved for your customer data, and store email_storage in a private location with retention rules.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
config/config.py:16- Finding
Mailbox credentials and API secrets are intended to be stored in tracked plaintext source code
- Content
View full analysis
### 3. Configure your settings Edit `config/config.py`: - **IMAP Settings**: Your email server, username and password - **Storage Path**: Where to save processed emails - **Translation**: Enable/disable translation and choose engine - **Company Info**: Your information for quote replies - **Schedule**: Check interval in minutes ``` ### Technical Analysis The bundled values are placeholders and are not leaked active credentials. However, the documented configuration procedure instructs users to place real mailbox usernames, mailbox passwords or app keys, and potentially translation API secrets directly into `config/config.py`. Because this is an ordinary project source file, it may be: - Committed to source control. - Included in project archives or support bundles. - Copied into backups with broad access. - Read by other users who can access the project directory. - Exposed when the project is published or shared. The implementation also does not reject placeholder values or ...[truncated 1335 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/email_utils.py:20- Finding
Optional plaintext IMAP mode permits unencrypted credential and email transmission
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/email_utils.py:153- Finding
Downloaded emails and generated business records use ambient filesystem permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Dependency installation is not fully pinned or integrity-verified
- Content
View full analysis
=1.3.0 langdetect>=1.0.9 googletrans==4.0.0-rc1 ``` ```markdown ### 2. Install dependencies ```bash pip install -r requirements.txt ``` ``` ### Technical Analysis `pandas` and `langdetect` use open-ended minimum version constraints. A future installation can therefore resolve to versions that were not represented by the audited source. No lock file or package hashes are supplied, so package artifacts are not integrity-verified against a reviewed set. The externally communicating `googletrans` dependency is pinned to a release-candidate version, but its transitive dependencies are not locked. This does not establish that any listed package is malicious. The risk is that installation is not reproducible and may consume changed, compromised, or incompatible code in the future. Python packages and their build systems may execute code during installation, while imported dependencies execute with the same operating-system privileges as the Skill at runtime. ### Attack Path 1. A user follows the README and runs `pip install -r requirements.txt`. 2. The package resolver selects current versions satisfying the open-ended constraints and resolves unpinned transitive dependencies. 3. A selected package or transitive component has been compromised, maliciously replaced, or introduces a security regression. 4. Installation hooks or imported runtime code execute under the user's account. 5. The compromised dependency can access data and resources available to that account, including configured mailbox credentials and locally stored emails. ### Impact Assessment The maximum impact of a malicious dependency is code execution with the privileges of the user installing or run ...[truncated 434 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </style> </head> <body> <!-- This is an example HTML template for sending quotation emails. You can customize this template according to your company branding. 这是一个用于发送报价邮件的HTML模板示例，你可以根据公司品牌需求自定义。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </style> </head> <body> <!-- This is an example HTML template for sending quotation emails. You can customize this template according to your company branding. 这是一个用于发送报价邮件的HTML模板示例,你可以根据公司品牌需求自定义。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation advertises automatic translation, including third-party engines such as Google and Baidu, without warning that customer email contents may be transmitted to external services. This is dangerous because inquiries may contain personal data, confidential designs, pricing, or business-sensitive information that could violate privacy obligations or confidentiality expectations when sent off-platform.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README states that the tool stores raw emails, extracted text, translations, quotes, and marks emails as read, but it does not warn users about the privacy and operational implications of doing so. This can lead to unexpected retention of sensitive customer data and unintended mailbox state changes that affect auditability, workflows, or incident response.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises automatic email retrieval, archival, and translation but does not clearly warn that customer emails will be persistently stored locally and that translation may transmit their contents to external services. In a business quoting workflow, these emails can contain personal data, contact details, pricing discussions, and proprietary requirements, so lack of disclosure and guidance increases privacy, compliance, and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly describes saving raw emails, extracted text, translations, and quote drafts to local storage, but does not warn users that customer communications may contain personal, commercial, or confidential data. This can lead to unintentional retention of sensitive information on disk without informed consent, access controls, or data-handling precautions, increasing privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that non-Chinese emails are automatically sent to translation APIs, but it does not disclose that customer message contents may be transmitted to third-party services outside the local environment. This creates confidentiality, privacy, and regulatory exposure because inquiry emails can include customer identities, contact details, order details, pricing discussions, or proprietary business information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script automatically translates email content when it is not in the target language and generates quotes in a predetermined language, with comments indicating a fixed language choice for foreign customers. This is a natural-language locale policy concern because the behavior is automatic and does not present any user choice or documented opt-in for language preference.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file fetches full email contents via IMAP and saves raw messages, extracted text, and generated quotations to disk. Although the functions are documented descriptively, there is no visible user disclosure, confirmation prompt, or explicit warning that potentially sensitive email data will be stored locally.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function and template explicitly generate a Chinese quotation reply, including a Chinese-only salutation and body, with no indication that the user's language preference is checked first. This creates a natural-language policy concern because it forces a specific language/locale rather than offering or detecting user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The docstring states that the module translates emails from non-target languages into a target language, and the implementation later uses a configured default target language. This describes a fixed language behavior without any natural-language indication that users can choose or opt into the locale, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The README states the tool detects 'non-target language' emails, translates them, and generates quotation replies in both Chinese and English, which suggests a preset language policy rather than a user-selected locale. Because no explicit opt-in or language choice is described here, this appears to impose a specific language workflow.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation encourages users to directly send auto-generated quotes without explicitly requiring manual review of pricing, quantities, customer details, or translated content. This can lead to erroneous or misleading business communications, especially because the tool parses untrusted inbound email content and may translate or infer requirements imperfectly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file sets
default_target_langtozh-CN, which imposes a specific locale by default. Under the policy, forcing a language without offering user choice or documenting a justified region-specific constraint is a natural-language policy concern.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The document switches into Chinese content and effectively requires readers to process both English and Chinese, but it does not state that the bilingual format is optional or limited to a specific locale. Under the language/locale policy check, forcing or assuming a language without user opt-in can be a policy issue.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency specification for pandas uses a lower-bound range instead of an exact pin, which makes builds non-reproducible and can cause the environment to resolve to unexpected or newly vulnerable releases over time. While this is not an exploit by itself, it is a real supply-chain hardening weakness because security posture depends on whatever version gets installed later.
- Content
text pandas>=1.3.0 langdetect>=1.0.9 googletrans==4.0.0-rc1
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency specification for langdetect is also unpinned, so installations may resolve to different versions across time and environments. This weakens reproducibility and increases supply-chain risk because a future compromised or vulnerable release could be pulled in without any change to this file.
- Content
text pandas>=1.3.0 langdetect>=1.0.9 googletrans==4.0.0-rc1
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The module docstring includes a Chinese description at L04 in addition to English, which indicates a language-specific presentation choice in natural-language content. The file does not state that multilingual output is optional or that the skill is intended for a specific locale, so this can conflict with a policy requiring user opt-in for language/locale constraints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The module docstring and comments include Chinese-language text alongside English, but there is no indication that language preference is user-selectable or justified as a region-specific requirement. Under the policy, locale-specific language should be optional or clearly documented.
- Content
Static analysis
No suspicious patterns detected.