ClawHub
Back to skill

Security audit

Simple SMTP Mailer

Security checks across malware telemetry and agentic risk

Overview

This email skill does what it says, but it lets an agent send mail from your account and relies on stored SMTP credentials without enough review safeguards.

Review before installing. Use an app-specific or least-privilege SMTP credential, prefer msmtp passwordeval or a system keychain instead of a plaintext password when possible, fix the hard-coded config path, and require the agent to show the exact recipient, sender, subject, and body for confirmation before any email is sent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill gives direct instructions for sending email through local SMTP credentials but does not warn that recipient addresses, subject lines, and message bodies will be transmitted using the user's configured account. In an agent setting, this can cause unintended outbound communication, data disclosure, or misuse of the user's mail identity if the assistant executes the command without explicit user awareness and confirmation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs users to place SMTP credentials, including a plaintext password, in a persistent local config file without emphasizing secure secret handling alternatives. Although it does recommend restrictive file permissions later, storing reusable credentials on disk increases exposure to local compromise, backups, accidental disclosure, and credential reuse risk.

Session Persistence

Medium
Category
Rogue Agent
Content
## Configuration

Create a configuration file at `~/.msmtp/config` with the following format:

```
account default
Confidence
88% confidence
Finding
Create a configuration file at `~/.msmtp/config` with the following format: ``` account default host <SMTP_SERVER> port <PORT> tls on tls_starttls off auth on user <EMAIL_ADDRESS> password <PASSWORD>

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.