Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent email integration, but its setup asks users to run an unverified remote Python script and stores mailbox credentials locally without enough safety guidance.
Review before installing. Use this only if you are comfortable sending email content and metadata through ClawMail, and do not run the setup script unless you can verify its source and contents. Treat ~/.clawmail/config.json as a secret, restrict its file permissions, keep it out of repositories and logs, and rotate or remove the credentials when no longer needed.
SKILL.md:13Unverified Remote Setup Script Download and Execution
The setup flow creates persistent local credentials for ongoing API access, which expands the blast radius of any later compromise of the agent host or workspace. While persistence is expected for an email integration, the README does not describe lifecycle controls such as revocation, least-privilege scoping, rotation, or secure storage, so the pattern is a real security concern in context.
Before using, run the ClawMail setup script to create your inbox:
curl -O https://clawmail.cc/scripts/setup.py
The README instructs users to download and execute a remote Python script directly from an external service without any integrity verification, pinning, or warning about the risk. If the server, DNS, TLS termination, or distribution path is compromised, users could run attacker-controlled code on their machine, making this especially dangerous in an agent skill installation context.
This markdown file documents network operations that send and retrieve email content, including recipient addresses and message bodies, but does not include an explicit warning that using the skill transmits potentially sensitive user data to an external service. Under the markdown criteria for SQP-2, behaviors affecting privacy should be disclosed clearly to the user.
The skill instructs users to download and execute a remote Python script directly from the vendor site without any integrity verification, signature check, pinning, or code review step. If the site, CDN, or connection path were compromised, this would enable arbitrary code execution on the host during setup.
If not already configured, run:
curl -O https://clawmail.cc/scripts/setup.py
python3 setup.py my-agent@clawmail.cc
The setup process stores live mailbox credentials in ~/.clawmail/config.json but does not instruct users to protect file permissions or avoid exposing the file to other local users, backups, logs, or repositories. If that file is read by another process or user, the attacker could poll the inbox, read messages, and send mail as the agent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Base URL
`https://api.clawmail.cc/v1`
## Check for New Emails
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Base URL
`https://api.clawmail.cc/v1`
## Check for New Emails
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Base URL
`https://api.clawmail.cc/v1`
## Check for New Emails
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Base URL
`https://api.clawmail.cc/v1`
## Check for New Emails
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if text: body['text'] = text
if html: body['html'] = html
r = requests.post(f'{self.base_url}/inboxes/{self.inbox_id}/messages',
headers=self.headers, json=body)
return r.json()
The setup instructions state that credentials will be written to ~/.clawmail/config.json but provide no warning about the sensitivity of that file, its permissions, or the implications of local credential storage. In an AI-agent environment, local plaintext credentials can be exposed to other tools, logs, backups, or users if not properly protected.
No suspicious patterns detected.