Security audit

Groundmail MCP Server

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious because it references an unpinned npm package that could change between launches; the review has medium confidence and some evidence is incomplete.

Before installing, consider whether you trust the package publisher and are comfortable with the package changing between launches. Prefer a reviewed, pinned version; the scan also could not resolve one local path-like reference, so its evidence is not complete.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

MCP server referenced without pinned version: 'npx -y groundmail-mcp'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The unversioned npx -y groundmail-mcp command can download and execute a changing npm release without an installation confirmation. If a future release or publisher account is compromised, malicious code could run with the user's privileges and access local files and the Groundmail API key; the legitimate setup context does not eliminate this supply-chain risk.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y groundmail-mcp'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This finding covers the same unpinned npm execution issue as the other finding at line 33, rather than an independent vulnerability. Both the stdio and HTTP examples can execute a compromised future package release with local privileges and access to credentials supplied to the server.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y groundmail-mcp'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The Claude Code configuration registers an unversioned npx -y groundmail-mcp command, allowing subsequent launches to resolve a changing package release rather than a reviewed artifact. A compromised release could execute with local user privileges and obtain the Groundmail API key explicitly passed into the server environment, potentially enabling unauthorized email operations.
Content: No source excerpt is available for this finding.