email-send-hanson

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:03 AM UTC
• Version: 1.0.0

Overview

This email skill matches its stated purpose, but it can automatically use mailbox credentials from nearby parent .env files to send or read email.

Review before installing. Use only a dedicated mailbox or app password, avoid running it from directories that contain unrelated .env files, and invoke read/send actions only after confirming the account, recipients, attachments, and message limits.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill searches upward from both the current working directory and the script directory to locate and automatically load the nearest .env file. In an agent or multi-project environment, this can cause the skill to ingest unintended credentials from a parent directory, enabling credential confusion, accidental cross-project account access, or use of attacker-planted configuration if the working directory is influenced.

Content

Scanner excerpt · scripts/server.py (reported line 303)May include surrounding context.

python

starts = [Path.cwd(), Path(__file__).resolve().parent]
    for start in starts:
        for directory in (start, *start.parents):
            env_file = directory / ".env"
            if env_file in seen:
                continue
            seen.add(env_file)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares capabilities to access environment variables, local files, and the network, but does not declare any explicit tool scope or permission boundaries in the skill manifest. For a skill that can send email and read inbox contents using mailbox credentials, this weakens transparency and increases the risk of overbroad execution or unintended data access by an agent runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description and usage guidance do not clearly warn that the skill consumes mailbox credentials from the environment and can read inbox contents. This can mislead operators or downstream agents about the sensitivity of the action, resulting in unintended exposure of email data or accidental execution in contexts where mailbox inspection was not expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code performs a network operation that can transmit user-provided body text, recipient addresses, and local file attachments to an external mail server. Although the script's purpose is email handling, there is no confirmation prompt, user-facing notice, or inline warning around the send path to disclose that local attachment files and message contents will be transmitted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The read path logs into an IMAP server and fetches full RFC822 messages, including message bodies and attachment metadata, which is a privacy-sensitive network/data access operation. The script contains no confirmation, visible notice, or inline warning informing the user that mailbox contents will be accessed and returned.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file explains that the skill reads email credentials, including passwords, from environment variables, but it does not include any warning about the sensitivity of those secrets or the privacy implications of using mailbox access. Under the markdown-specific missing-warning rule, documentation should warn users when behavior affects privacy or sensitive data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The configuration loader reads sensitive credentials such as EMAIL_PASSWORD or SMTP_PASS from the environment, which qualifies as access to credentials. There is no user-facing message, warning, or explanatory comment near this behavior beyond the generic module docstring.

Content

No source excerpt is available for this finding.