ClawHub
Back to skill

Security audit

Agent Mail

Security checks for vulnerabilities and agentic risk

Overview

This skill is an email agent with no code payload, but it exposes and persists sensitive mailbox activity with weak scoping and disclosure.

Review this before installing if you expect it to handle private or business email. Confirm whose AgentMail account and API key it uses, when it may read inbox contents or attachments, whether it asks before sending mail, and how data saved under /workspace/data/emails/ can be reviewed or deleted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: "00000000000000000000000000000000"
    PropagateID: "00000000000000000000000000000000"
    ReservedCode1: 30450220270e35dac14285ad85a59ef4ea08be446e67377133a38d9ef80cb5d29b82fe19022100f07dbedeeb931aa5c3f8f12e77486e89885d175d77a0f9c81bb0efc44c46aedd
    ReservedCode2: 3044022041fd22373ed72d76ce85e2e467eb3d054387fde8fa80de0a812052ace31adf270220720b01010a024ef307b9a3a8da0920857bcef8e27a949aeb6ff415499e93799e
description: 邮件智能处理。使用 AgentMail API 收发邮件。
metadata:
    category: 生产力
    emoji: "\U0001F4E7"
    triggers:
        - 邮件
        - email
        - 发邮件
        - 收邮件
        - mail
name: agent-mail
---

# Agent Mail 技能

基于 AgentMail 的智
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger set includes very broad terms such as '邮件', 'email', and 'mail', which can cause the skill to activate in contexts the user did not intend. For a mail-capable skill, unintended invocation can expose inbox contents, send messages, or operate on sensitive communications without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill handles highly sensitive data—emails, attachments, and conversation threads—and stores mail data locally under '/workspace/data/emails/' without presenting a clear user-facing privacy warning. This increases the risk of users unknowingly granting access to confidential communications and local persistence that may outlive the immediate task.

Description-Behavior Mismatch

Low
Confidence
90% confidence
Finding
The skill documentation discloses a specific mailbox address while stating the API key is configured, which exposes operational account details in a public-facing manifest. Even without the key, publishing the mailbox can invite spam, targeting, social engineering, or unintended use of a shared account.

Static analysis

No suspicious patterns detected.