Security audit

MAMA

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent mail assistant, but it handles mailbox credentials and has review-worthy control gaps around executable config files and immediate mail sending.

Review before installing if you are not comfortable giving this skill IMAP/SMTP access to your mailboxes. Keep `scripts/mail_config.json`, any legacy `mail_config.py`, and `digest_config.py` private and writable only by trusted users; prefer draft-generation workflows; use immediate send or move commands only after checking the account, recipient, subject, and message content.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill clearly instructs use of shell commands, local file reads/writes, environment variables, and IMAP/SMTP network access, yet no permissions are declared. This creates a capability-transparency gap: the runtime may allow broad actions users and policy layers cannot accurately pre-approve, increasing risk of unintended data access, mail sending, or secret handling.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: load_python_config() executes an external Python file via spec.loader.exec_module(module), which allows arbitrary code execution if an attacker can modify or replace the config file path or contents. In a mail-agent context, this is more dangerous because the process may have access to sensitive mailbox data, filesystem contents, and credentials, turning a config injection into full compromise of the agent runtime.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script selects the sender account purely from global config values instead of binding the forward action to the account from which the chosen email originated. In a multi-account mail agent, this can cause cross-account forwarding, leaking message contents or attachments through the wrong mailbox and violating the stated account-isolation requirement.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The legacy configuration loader imports and executes a Python file via spec.loader.exec_module(module), which gives arbitrary code execution if an attacker can modify or supply the config path or config file. In a mail agent context, successful exploitation could expose mailbox credentials, alter account settings, send mail, or pivot into the host environment.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger list includes broad phrases such as '检查邮箱', '查看邮箱', '搜索邮件', and '发送邮件', which are common natural-language requests. Over-broad activation can invoke this skill unintentionally in unrelated conversations, causing unnecessary mailbox access or even preparation of drafts/actions in a sensitive email context.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: When --send is used, the tool will immediately transmit the selected email body and any attached raw .eml to the typed recipient without an explicit confirmation step showing the final recipient, sender, and data being sent. In a mail-forwarding utility that handles potentially sensitive content across multiple accounts, this increases the risk of accidental disclosure from mistyped recipients or operator misunderstanding.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The interactive review flow allows forwarding or immediate sending of email content after displaying the selected message, but it does not present an explicit warning that sensitive email body/content may be transmitted to an external recipient. In a multi-account mail agent that handles cross-account inspection and forwarding, this increases the risk of accidental data exfiltration, especially when users may act quickly or misunderstand the recipient/account context.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/analyze_emails.py:70

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/forward_mail.py:33

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/init_config.py:272

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/mail_accounts.py:33