ClawHub
Back to skill

Security audit

imap-smtp-email

Security checks across malware telemetry and agentic risk

Overview

This email skill handles sensitive mail credentials and message content, but its behavior is coherent with its stated IMAP/SMTP purpose and is user-directed.

Install only if you are comfortable giving the skill access to your email account via app password or authorization code. Keep ALLOWED_READ_DIRS and ALLOWED_WRITE_DIRS narrow, review any body files or attachments before sending, and prefer reproducible dependency installation from the included lockfile.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill supports sending email and test messages, but the description around these commands does not clearly warn that recipient addresses, message content, attachments, and metadata are transmitted off-host over the network. In an agent setting, insufficient disclosure can lead users to provide sensitive local content for body files or attachments without realizing it will be exfiltrated to remote mail servers and recipients.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"test": "node ../../tests/imap-smtp-email/search-filter.test.js"
  },
  "dependencies": {
    "dotenv": "^16.6.1",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
Confidence
93% confidence
Finding
"dotenv": "^16.6.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "dotenv": "^16.6.1",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
    "nodemailer": "^9.0.3"
Confidence
93% confidence
Finding
"imap": "^0.8.19"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "dotenv": "^16.6.1",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
    "nodemailer": "^9.0.3"
  },
Confidence
93% confidence
Finding
"imap-simple": "^5.1.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dotenv": "^16.6.1",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
    "nodemailer": "^9.0.3"
  },
  "keywords": [
Confidence
93% confidence
Finding
"mailparser": "^3.9.3"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
    "nodemailer": "^9.0.3"
  },
  "keywords": [
    "imap",
Confidence
93% confidence
Finding
"nodemailer": "^9.0.3"

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.