163 Email Monitor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:19 AM UTC
• Version: 1.0.1

Overview

This looks like a real 163/126/yeah.net email client, but it needs review because it can use stored email credentials to send messages and arbitrary local attachments without a built-in confirmation step.

Install only if you are comfortable giving this skill access to a 163/126/yeah.net mailbox authorization code. Before using send or --attach, verify the recipient, message body, and every attachment path yourself; avoid attaching secrets or private files unless you explicitly intend to email them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

Only reads IMAP/SMTP server settings and credentials.
    """
    if env_path is None:
        env_path = os.path.expanduser("~/.openclaw/email-monitor/.env")
    
    config = {}
    if not os.path.exists(env_path):

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill describes capabilities that read local credential files and connect to external IMAP/SMTP servers, but it does not declare any tool scope or permissions boundary. This creates a mismatch between documented behavior and effective capability, which can lead to unintended file access and network transmission without clear review or user consent.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation text is broad enough to match common requests like checking email, reading mail, sending email, or monitoring an inbox, which raises the chance of accidental invocation. In a skill that accesses stored credentials and external mailboxes, overbroad triggering can expose sensitive email content or send messages when the user did not intend to use this specific integration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The usage section instructs users to send email content and attachments to external SMTP/IMAP services but does not clearly warn that message bodies, search queries, and attachments will be transmitted to third-party mail servers. Without an explicit disclosure, users may unknowingly expose sensitive data during normal use.

Session Persistence

Medium

• Category: Rogue Agent

Content

config = {}
    if not os.path.exists(env_path):
        print(f"Error: Configuration file not found: {env_path}")
        print("Please create the file with your email settings.")
        sys.exit(1)
    
    try:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code can transmit email and attachments immediately once arguments are supplied, with no interactive confirmation, dry-run preview, or policy gate. In an agent context, this creates a meaningful risk of unauthorized outbound communication and data exfiltration, especially when combined with arbitrary attachment reads.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The send command accepts arbitrary filesystem paths in --attach and reads them directly, allowing the skill to exfiltrate any local file the invoking agent can access. In an agent setting, this is more dangerous than a normal CLI mail client because a prompt or workflow could cause unintended disclosure of secrets, SSH keys, config files, or user documents via email.

Static analysis

No suspicious patterns detected.