Security audit

AgentMail MCP CLI

Security checks for vulnerabilities and agentic risk

Overview

This email-management skill is coherent, but it asks for broad mailbox authority through mutable npm commands and broad activation terms, so users should review it before installing.

Install only if you trust the AgentMail CLI package source and are comfortable granting the provided API key access to mailbox contents and outbound email actions. Use the narrowest AgentMail API key available, review recipients and destructive inbox operations before approving them, avoid unpinned npx examples, and prefer pinned package versions or an isolated environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Third-Party Packages Can Execute Unreviewed Code
Content: View full analysis
\ to:'["user@example.com"]' \ subject:"Hello" \ text:"Body" ``` ### Technical Analysis The Skill instructs users and the hosting framework to install `openclaw-agentmail-cli` without an exact version or integrity constraint. It also recommends invoking `mcporter` through `npx` without specifying a version. An unversioned npm installation resolves to the package release selected by the registry at installation time. The effective code can therefore change after this Skill has been reviewed. A compromised maintainer account, malicious package release, registry compromise, or package ownership transfer could cause users to install code that was not part of the audited artifact. The global installation command may run npm lifecycle scripts and installs the executable into the user's global npm environment. Similarly, `npx mcporter` may retrieve and immediately execute a package when it is not already available locally. The project contains no dependency lockfile, integrity hash, vendored implementation, or executable source through which the installed behavior can be independently verified. This is a supply-chain risk rather than evidence that the currently referenced packages are malicious. ### Attack Path 1. An attacker compromises the npm account, release process, repository, or registry entry for `openclaw-agentmail-cli` or `mcporter`. 2. The attacker publishes a malicious release under the expected package name. 3. A user or ...[truncated 1432 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises very broad trigger phrases such as email, inbox, and send email, which can cause the skill to activate in many contexts beyond the user's specific intent. Since the skill can read, send, reply to, and forward emails, over-broad activation increases the chance of unintended access to sensitive communications or accidental outbound actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation describes extensive email access and transmission capabilities but does not clearly warn users that the skill can expose privacy-sensitive mailbox contents, metadata, attachments, and recipient lists. In the context of an email-management tool, lack of clear consent and privacy warnings makes accidental disclosure, unauthorized processing, or unsafe automation more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The documentation instructs users to run npx mcporter without pinning a specific version, which allows execution of whatever package version is current at install time. In a security-sensitive email-management skill, this creates a supply-chain risk: a compromised or malicious upstream release could execute code in the user's environment and potentially access API keys or email data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: This second npx mcporter invocation repeats the same unpinned-package pattern, again exposing users to arbitrary code execution through a mutable upstream dependency. Because the skill handles an AGENTMAIL_API_KEY and email operations, compromise of the invoked package could lead to credential theft or unauthorized mailbox access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.