Local Mail Server

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:46 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for setting up a mail server, but its published instructions include unsafe production mail configuration patterns that could expose credentials, mail traffic, or relay access.

Review carefully before installing. Replace all example passwords, do not disable TLS certificate verification, bind mail services only to intended loopback or Tailscale addresses, narrow Postfix relay trust to exact peers, verify downloaded binaries, and avoid exposing the management API or relay service publicly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Downloaded Stalwart Executable Is Run Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:64-72` **Vulnerability Type**: Remote payload retrieval and execution without checksum or signature validation **Risk Level**: High ```bash # macOS ARM64 curl -L -o stalwart.tar.gz "https://github.com/stalwartlabs/stalwart/releases/download/v0.15.5/stalwart-aarch64-apple-darwin.tar.gz" # Linux x86_64 curl -L -o stalwart.tar.gz "https://github.com/stalwartlabs/stalwart/releases/download/v0.15.5/stalwart-x86_64-unknown-linux-gnu.tar.gz" tar -xzf stalwart.tar.gz chmod +x stalwart ./stalwart -c config/config.toml ``` ### Technical Analysis The instructions retrieve a binary archive from the official Stalwart Labs GitHub release location, extract it, mark the resulting file as executable, and immediately run it. Although the source is consistent with the Skill's declared functionality and is not an unrelated paste or personal hosting service, no cryptographic checksum or release signature is verified. HTTPS protects the connection in transit but does not protect users if the upstream project account, release asset, build pipeline, or certificate trust path is compromised. Redirect following through `curl -L` also means the effective download host may differ from the URL initially displayed. ### Attack Path 1. An attacker compromises the upstream release process, repository account, release asset, or another component of the download path. 2. The attacker substitutes a modified archive for one of the documented release artifacts. 3. A user follows the Skill instructions and downloads the modified archive. 4. Because no checksum or signature is checked, extraction and execution proceed normally. 5. The substituted executable runs arbitrary code with all permissions of the invoking account. ### Impact Assessment Successful exploitation provides arbitrary code execution as the user running the installation. The payload could access that user's files and credentia ...[truncated 219 chars]
• Remediation: ## Remediation Suggestions - Publish a trusted SHA-256 or stronger digest for each supported archive and verify it before extraction. - Prefer verification using a cryptographically signed release manifest whose signing key is distributed through an independent trusted channel. - Use `curl --fail --show-error --location` and stop the installation if the download or verification fails. - Extract into a newly created, permission-restricted directory rather than the current directory. - Run the server under a dedicated unprivileged service account with access only to required mail data and configuration. - Prefer an authenticated official package repository when the vendor provides one. - Document the expected archive contents and avoid running the resulting executable with `sudo` or as root.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:171
• Finding: Predictable Administrator and Mailbox Credentials in Copyable API Example## Vulnerability Details **File Location**: `SKILL.md:171-190` **Vulnerability Type**: Predictable reusable credentials **Risk Level**: High ```bash curl -X POST "http://localhost:8080/api/principal" \ -u admin:admin123 \ -H "Content-Type: application/json" \ -d '{ "type": "individual", "name": "username", "emails": ["[e-mail]"], "secrets": ["SecurePassword123"], "enabledPermissions": [ "email-receive", "authenticate", "email-send", "imap-authenticate", "imap-enable", "imap-list", "imap-select", "imap-fetch" ] }' ``` ### Technical Analysis The operational example embeds the predictable administrator credential `admin:admin123` and creates a mailbox using `SecurePassword123`. These appear to be examples rather than secrets extracted from a deployed environment, but users can copy the command unchanged. The documentation does not force replacement of the values or require immediate credential rotation. The administrator credential is also sent to an HTTP URL. Loopback limits ordinary network interception, but plaintext authentication remains visible to sufficiently privileged local processes and becomes remotely exposed if the management listener is later rebound, proxied, or forwarded. ### Attack Path 1. An administrator copies the documented command without replacing the example credentials. 2. The management account retains `admin123`, or the new mailbox retains `SecurePassword123`. 3. An attacker obtains connectivity to the management service or a relevant mail authentication service through local access, a proxy, port forwarding, or accidental interface exposure. 4. The attacker authenticates using the publicly documented credentials. 5. Depending on which credential remains active, the attacker controls the management API or accesses and sends mail through the created account. ### Impact As ...[truncated 421 chars]
• Remediation: ## Remediation Suggestions - Replace literal credentials with mandatory placeholders that cannot work unchanged, such as `${STALWART_ADMIN_USER}` and `${NEW_MAILBOX_PASSWORD}`. - Read secrets from protected environment variables, a secret manager, or interactive hidden prompts. - Generate unique high-entropy passwords and explicitly require rotation of all initial credentials. - Configure the management interface to listen only on loopback or a dedicated administrative network. - Use HTTPS with a validated certificate even for management access, particularly if a reverse proxy or remote administration is introduced. - Add a warning that example values must never be used in production. - Rate-limit authentication and monitor logs for repeated use of common or documented credentials.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:218
• Finding: Nextcloud Mail TLS Peer Verification Is Disabled## Vulnerability Details **File Location**: `SKILL.md:218-223` **Vulnerability Type**: Disabled TLS certificate validation **Risk Level**: High ```bash cd /path/to/nextcloud php occ config:system:set "allow_local_remote_servers" --value="true" php occ config:system:set "app.mail.verify-tls-peer" --value="false" --type=boolean ``` ### Technical Analysis The instructions explicitly disable TLS peer verification for the Nextcloud Mail application. Encryption without certificate validation does not authenticate the server. A client may therefore accept a certificate controlled by an attacker rather than confirming that it is communicating with the intended IMAP or SMTP service. Loopback-only operation reduces exposure, but the setting is broader and more durable than necessary. It remains unsafe if the server address changes, traffic is redirected, a local service is replaced, or Nextcloud connects over a network interface. ### Attack Path 1. The administrator applies the documented setting and disables peer validation. 2. An attacker gains the ability to redirect the mail connection, control the configured endpoint, alter local name resolution, or replace the expected local listener. 3. The attacker presents any TLS certificate. 4. Nextcloud accepts the certificate because peer verification is disabled. 5. The client transmits authentication credentials and mail data to the impersonating endpoint, or accepts manipulated server responses. ### Impact Assessment Exploitation can expose IMAP or SMTP credentials and email content available through the affected account. Captured credentials may permit mailbox access and mail submission. An active attacker could also alter messages in transit or impersonate the configured mail service. The attack requires control over connection routing or the destination endpoint.
• Remediation: ## Remediation Suggestions - Keep `app.mail.verify-tls-peer` enabled. - Issue a certificate containing the exact hostname used by Nextcloud and configure that hostname rather than relying on an address absent from the certificate. - For an internal certificate authority, import the CA certificate into the appropriate operating-system or PHP trust store. - Use a narrowly scoped per-service trust configuration if supported instead of disabling validation globally. - Restrict local mail listeners and protect configuration and name-resolution files from unauthorized modification. - If loopback transport is intentionally used without TLS, document the local trust boundary explicitly rather than presenting unverified TLS as authenticated encryption.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:130
• Finding: Postfix Trusts an Excessively Broad Network Range for Relaying## Vulnerability Details **File Location**: `SKILL.md:130-138` **Vulnerability Type**: Overbroad trusted relay network and interface exposure **Risk Level**: High ```ini myhostname = relay.yourdomain.com mydomain = relay.yourdomain.com mydestination = $myhostname, localhost mynetworks = 127.0.0.0/8, 100.0.0.0/8 # 包含 Tailscale 网段 inet_interfaces = all smtp_cname_overrides_servername = no disable_dns_lookups = yes transport_maps = hash:/etc/postfix/transport ``` ### Technical Analysis Postfix commonly uses `mynetworks` as a trusted-client boundary for relay authorization. The documented `100.0.0.0/8` range is substantially broader than the specific Tailscale peer required by the architecture. It also extends beyond Tailscale's carrier-grade NAT allocation of `100.64.0.0/10`. In combination with `inet_interfaces = all`, Postfix listens on all available interfaces while treating a large address range as trusted. This exceeds the minimum privilege and network access required to forward mail between one VPS and one local Tailscale host. ### Attack Path 1. The VPS is configured using the documented `mynetworks` and wildcard interface settings. 2. An attacker obtains network reachability to Postfix with a source address that falls within the trusted range, such as through an authorized or compromised overlay-network peer, routing error, or another reachable interface. 3. Postfix classifies the connection as originating from a trusted network. 4. Subject to the remainder of the deployed relay restrictions, the attacker submits mail to third-party destinations without normal authentication. 5. The server is used to distribute spam or malicious mail until detected or blocklisted. ### Impact Assessment The principal impact is unauthorized use of the VPS as a mail relay. This can consume bandwidth and processing resources, damage domain and IP reputation, trigger provider suspension, and cause legitimate mail to be rej ...[truncated 133 chars]
• Remediation: ## Remediation Suggestions - Replace `100.0.0.0/8` with the exact trusted Tailscale host address using `/32` for IPv4 or `/128` for IPv6. - Do not treat the complete Tailscale address range as trusted merely because it is associated with the overlay network. - Bind Postfix only to the public SMTP address and required private address instead of all interfaces. - Apply host firewall rules and Tailscale ACLs that permit relay traffic only between the explicitly designated peers. - Require SMTP authentication where feasible rather than relying solely on source-address trust. - Confirm that `smtpd_relay_restrictions` rejects unauthenticated, untrusted relay attempts. - Test the deployed server from an external host to confirm that it is not an open relay.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:107
• Finding: Stalwart Mail Listeners Bind to Every Network Interface## Vulnerability Details **File Location**: `SKILL.md:107-111` **Vulnerability Type**: Unnecessary network service exposure **Risk Level**: Medium ```toml # 服务器基本配置 server.hostname = "mail.yourdomain.com" server.listener.smtp.bind = ["[::]:25"] server.listener.imap.bind = ["[::]:143"] server.listener.submission.bind = ["[::]:587"] ``` ### Technical Analysis The wildcard IPv6 address `[::]` binds SMTP, IMAP, and submission services to every IPv6 interface. Depending on operating-system dual-stack behavior, it may also accept IPv4 connections. This conflicts with the described architecture, where inbound relay communication should occur through a designated Tailscale address and local clients can use loopback. Exposing all three services to every attached network increases the reachable attack surface and exceeds the minimum interfaces needed for the stated deployment. The effect is particularly significant on a host that has a public address, an untrusted LAN, or multiple virtual networks. ### Attack Path 1. The administrator deploys the wildcard listener configuration. 2. The host has an interface reachable by an untrusted LAN, public network, container network, or other tenant. 3. An attacker discovers ports 25, 143, or 587 through scanning or service enumeration. 4. The attacker interacts directly with Stalwart, attempts credential guessing, probes relay controls, or targets a vulnerability in the exposed protocol implementation. 5. If authentication is weak or the service contains an exploitable flaw, the attacker obtains mailbox access, mail submission capability, or the privileges available to the mail-server process. ### Impact Assessment The confirmed configuration issue is unnecessary service reachability; successful compromise depends on additional authentication or implementation weaknesses. Potential impact includes password attacks, unauthorized mail access or submission, denial of service, and exploi ...[truncated 224 chars]
• Remediation: ## Remediation Suggestions - Bind SMTP relay reception only to the exact Tailscale address used by the VPS. - Bind IMAP and submission to loopback when all clients are local, or to explicitly selected private addresses when remote access is required. - Enforce host firewall rules independently of application binding. - Require authenticated TLS for IMAP and submission and disable plaintext authentication before TLS negotiation. - Rate-limit authentication attempts and monitor for brute-force activity. - Keep the Stalwart process unprivileged and isolate its writable data from unrelated system files. - Document separate secure listener examples for local-only and remote-client deployments rather than using wildcard binds as the default.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Chaining Abuse

High

• Category: Tool Misuse

Content

sudo apt install -y postfix opendkim opendkim-tools

# 配置 Postfix 转发到本地服务器
echo "yourdomain.com    smtp:[LOCAL_TAILSCALE_IP]:25" | sudo tee /etc/postfix/transport
sudo postmap /etc/postfix/transport
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Disabling TLS peer verification without a clear, narrowly scoped safety warning is a genuine security issue because it instructs users to bypass a fundamental authenticity check. In a mail workflow, this can expose login credentials and message traffic to interception by any attacker able to tamper with the network path.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description declares trigger words including "email", "imap", and "smtp", which are broad terms that can appear in many ordinary conversations or technical contexts unrelated to this specific local mail-server skill. The trigger specification also lacks clear boundaries or negative examples explaining when the skill should not activate.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 在 VPS 上安装 Postfix 和 OpenDKIM
sudo apt update
sudo apt install -y postfix opendkim opendkim-tools

# 配置 Postfix 转发到本地服务器

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 在 VPS 上安装 Postfix 和 OpenDKIM
sudo apt update
sudo apt install -y postfix opendkim opendkim-tools

# 配置 Postfix 转发到本地服务器

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 在 VPS 上安装 Postfix 和 OpenDKIM
sudo apt update
sudo apt install -y postfix opendkim opendkim-tools

# 配置 Postfix 转发到本地服务器

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 在 VPS 上安装 Postfix 和 OpenDKIM
sudo apt update
sudo apt install -y postfix opendkim opendkim-tools

# 配置 Postfix 转发到本地服务器

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 在 VPS 上安装 Postfix 和 OpenDKIM
sudo apt update
sudo apt install -y postfix opendkim opendkim-tools

# 配置 Postfix 转发到本地服务器

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 在 VPS 上安装 Postfix 和 OpenDKIM
sudo apt update
sudo apt install -y postfix opendkim opendkim-tools

# 配置 Postfix 转发到本地服务器

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 在 VPS 上安装 Postfix 和 OpenDKIM
sudo apt update
sudo apt install -y postfix opendkim opendkim-tools

# 配置 Postfix 转发到本地服务器

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The documentation demonstrates accessing the management API over plain HTTP with a default-looking administrative credential (`admin:admin123`) while later advising that the management interface should only be locally bound. Even if intended for localhost only, publishing default credentials and normalizing unauthenticated-looking setup patterns can lead to immediate compromise if the service is rebound, proxied, exposed by port forwarding, or accessed from a less-trusted local environment.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The user-management section includes live credential-handling patterns and account creation examples without a strong warning against exposing passwords, reusing example credentials, or storing secrets in shell history. In a mail-server administration context, this increases the chance of credential leakage and insecure operational practices.

External Transmission

Medium

• Category: Data Exfiltration

Content

通过 Stalwart Web UI (http://localhost:8080) 或 API：

```bash
curl -X POST "http://localhost:8080/api/principal" \
  -u admin:admin123 \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The Nextcloud instructions explicitly disable TLS peer verification, which defeats certificate validation and enables man-in-the-middle attacks against IMAP/SMTP connections. This undermines the confidentiality and integrity of mail credentials and message contents, especially because the skill is about a production mail system where secure transport is a core requirement.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 邮件无法接收

1. 检查 VPS Postfix 日志：`sudo tail -f /var/log/mail.log`
2. 确认 DNS MX 记录指向 VPS IP
3. 确认 Tailscale 连接正常
4. 检查 VPS 防火墙是否开放 25 端口

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The skill content is written entirely in Chinese and does not state that the language is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, a language constraint should either be optional for users or clearly documented as a justified locale-specific requirement.

Static analysis

No suspicious patterns detected.