Apple Mail Search Safe.Bak

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:24 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Apple Mail search helper that can read email contents and uses an external npm CLI, so it should be installed and used with care but does not show deception or destructive behavior.

Install only if you are comfortable giving the CLI and your agent access to Apple Mail search results and full message bodies. Prefer narrow queries, avoid requesting body text unless needed, and consider verifying or pinning the npm package before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Third-Party npm Package Installed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–17 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g apple-mail-search-cli ``` Related package configuration at `SKILL.md`, line 6: ```yaml metadata: {"clawdbot":{"emoji":"📧","requires":{"bins":["fruitmail"]},"install":[{"id":"node","kind":"node","package":"apple-mail-search-cli","bins":["fruitmail"],"label":"Install fruitmail CLI (npm)"}]}} ``` ### Technical Analysis The Skill delegates its entire implementation to the external npm package `apple-mail-search-cli`. The dependency is installed globally without an exact version or integrity hash. The artifact does not include the package source, a lockfile, a checksum, or another mechanism that cryptographically associates the installed package with reviewed code. The Skill links to a GitHub repository named `fruitmail-cli`, while the installed npm package is named `apple-mail-search-cli`. This naming difference is not proof of malicious behavior, but the supplied artifact provides no verifiable binding between the repository and the npm release. An npm installation can execute package lifecycle scripts under the privileges of the invoking user. Because package resolution is unpinned, future installations may retrieve a version that differs from the one originally reviewed or intended. The executable installed by the package is subsequently expected to access Apple Mail's SQLite database and retrieve complete message bodies through AppleScript. ### Attack Path 1. An Agent or user follows the installation instructions in `SKILL.md`. 2. npm resolves the current release of the unpinned `apple-mail-search-cli` package from the configured registry. 3. A compromised, replaced, or unexpectedly modified release executes lifecycle scripts during installation or installs a hostile `fruitmail` executable. 4. The package code runs with the invoking user's privileges. 5. W ...[truncated 903 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `apple-mail-search-cli` to a specific reviewed version rather than resolving the latest release. 2. Record and verify the package integrity hash before installation. 3. Include a lockfile or equivalent reproducible dependency manifest. 4. Establish a verifiable mapping between the npm release and a reviewed source commit, such as signed tags and provenance attestations. 5. Prefer a project-local installation over `npm install -g` to reduce system-wide exposure. 6. Disable npm lifecycle scripts where they are unnecessary, for example by using `--ignore-scripts` after confirming that the package does not legitimately require them. 7. Vendor and audit the implementation within the Skill package when feasible. 8. Run the tool with least privilege and grant only the macOS privacy permissions required to read Apple Mail data. 9. Document the precise files, applications, and privacy permissions accessed by the executable. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly supports reading full email body text from Apple Mail, but the documentation does not clearly warn users that invoking these commands can expose sensitive mailbox contents such as personal, financial, or authentication-related information to the agent or downstream tools. In an agent setting, this omission increases the chance of over-collection and unintended disclosure because users may treat a search utility as low-risk metadata lookup rather than full-content access.

Static analysis

No suspicious patterns detected.