T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imap_scan.py:167- Finding
Mailbox Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Email Registration Scanner
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate email-audit purpose, but it handles mailbox credentials and scan results in ways users should review carefully before installing.
Install only if you are comfortable granting access to email account history. Prefer OAuth or app-specific passwords, avoid regular mailbox passwords, do not run plaintext IMAP except to a trusted local Proton Bridge, and delete any generated JSON results after use because they can reveal a map of your online accounts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imap_scan.py:121- Finding
Plaintext IMAP Authentication Allowed for Arbitrary Remote Hosts
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imap_scan.py:228- Finding
Sensitive Mailbox-Derived Results Written Without Enforced Protection or Cleanup
- Content
View full analysis
0: print(f"[scanner] Processed {i}/{len(seen_ids)} emails...") time.sleep(0.05) imap.logout() final = sorted(service_map.values(), key=lambda x: x["date"], reverse=True) with open(args.output, "w", encoding="utf-8") as f: json.dump(final, f, ensure_ascii=False, indent=2) print(f"[scanner] Done. {len(final)} unique services found → {args.output}") ``` The Skill text places cleanup responsibility outside the script: ```markdown - Delete temp files (`/tmp/registration_scan_*.json`) after the session ends. ``` ### Technical Analysis The output includes sender identities, subjects, dates, and inferred service registrations. This data can reveal the user’s online accounts, financial or health-related services, personal interests, and other sensitive relationships. The script opens the caller-selected output path using the default process permissions. It does not enforce mode `0600`, does not create a private temporary directory, and does not protect against pre-existing paths or symbolic links. File confidentiality therefore depends on the ambient `umask` and filesystem configuration. The script also does not delete the output. Cleanup exists only as an Agent instruction, even though the README claims temporary files are deleted after e ...[truncated 1339 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The introductory description emphasizes convenience and outcomes but does not prominently warn that the skill will access and scan the user's email account contents. Because email inboxes contain highly sensitive personal and account data, insufficient disclosure can undermine informed consent and cause users to authorize broader access than they expected.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
https://github.com/fatihbtw/email-registration-scanner
Option 2 – manual
mkdir -p ~/.openclaw/skills/email-registration-scanner cp -r . ~/.openclaw/skills/email-registration-scanner
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The invocation phrases are broad and include natural-language requests like 'Where am I registered?' and 'Scan my emails for registrations,' which could be triggered during ordinary conversation. In the context of a skill that accesses mailbox contents, accidental invocation can lead to unintended scanning of sensitive email data and privacy exposure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to use network access and write temporary files, but it does not declare any explicit tool scope or allowed-tools restrictions. For a skill that handles mailbox credentials and scans large volumes of sensitive email metadata, missing scope boundaries increases the chance of over-privileged execution, unintended tool use, or unsafe file/network operations beyond what the user expects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to match common account-management requests like 'show me all my accounts,' which could invoke a full mailbox scan when the user may have intended something narrower. Because this skill can access highly sensitive historical registration data across multiple providers, over-triggering creates a meaningful privacy and consent risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill scans entire mailboxes for historical registrations, which can reveal a detailed inventory of the user's online accounts and associated timelines, but the description does not prominently warn about that privacy impact up front. In this context, insufficient disclosure undermines informed consent and makes it easier for users to authorize a highly sensitive scan without understanding the breadth of exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script accepts raw mailbox credentials as command-line arguments and immediately uses them for IMAP authentication, but provides no explicit warning or safer handling path for these sensitive secrets. Command-line passwords can be exposed via shell history, process listings, logs, or orchestration layers, making this especially risky for a skill designed to access an entire email account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes a detailed inventory of the user's registrations, including sender addresses, subjects, and dates, to a local JSON file without any explicit consent prompt, warning, or retention guidance. In the context of a mailbox-registration scanner, this output is highly privacy-sensitive because it reveals a broad map of the user's online accounts and could be exposed through insecure temp paths, shared systems, or later collection by other components.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description states the skill scans email accounts for registration, welcome, and confirmation emails to build a historical list of all services a user has signed up for, but it does not document any trigger boundaries, mailbox scope limits, or explicit user-consent constraints. Because email history is highly sensitive, broad activation language can cause over-collection or unexpected invocation beyond what a user reasonably intended.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This reference mixes English instructions with provider-specific German phrases such as "POP3/IMAP abrufen," which can impose a language/locale assumption on users. Because the file does not state that these steps are specific to German-localized interfaces or provide alternative locale guidance, it may violate the language/locale policy criterion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
Line L003 instructs users to run query batches for different languages as a fixed sequence, and the remainder of the file defines a predetermined set of supported locales. Because the file does not explain that these are optional examples or provide a way to choose/add locales, it embeds a locale policy that may exclude other languages without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description promises comprehensive scanning of a user's email history to reconstruct registrations across services, which creates a privacy risk because it implies large-scale review of sensitive personal communications without any visible limitation or opt-in wording. In this skill context, the data being inferred can reveal the user's accounts, habits, health, finances, and other sensitive affiliations, making the lack of scope and consent language more dangerous.
- Content