T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/gmail.sh:29- Finding
Arbitrary Shell Command Execution Through Gmail Command Construction
- Content
View full analysis
- Remediation
View remediation
Security audit
one-mail
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed multi-provider email CLI, but its current implementation has serious command-injection and credential-handling risks.
Review carefully before installing. Use only on a trusted machine, treat ~/.onemail/credentials.json as highly sensitive, prefer revocable OAuth tokens or app-specific passwords, verify recipients and attachment paths before sending, avoid unattended forwarding or cron jobs, and patch the eval/Python interpolation and credential-retention issues before using real mailboxes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/163.sh:57- Finding
Arbitrary Python Code Execution Through NetEase Heredoc Interpolation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/read.sh:113- Finding
Outlook Search Query Injected Into Python Command Source
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/common.sh:15- Finding
Plaintext Credentials Are Exported to Child Processes and Not Reliably Removed
- Content
View full analysis
&2 exit 1 fi CONFIG=$(cat "$CONFIG_FILE") export CONFIG if [ ! -f "$CREDS_FILE" ]; then echo "❌ Credential file does not exist" >&2 exit 1 fi CREDS=$(cat "$CREDS_FILE") export CREDS } ``` Setup replaces the original mode-600 file with a newly created temporary file without reapplying the mode: ```bash jq --arg client_secret "$client_secret" \ --arg refresh_token "$refresh_token" \ '.outlook = { "client_secret": $client_secret, "refresh_token": $refresh_token }' "$CREDS_FILE" > "$CREDS_FILE.tmp" mv "$CREDS_FILE.tmp" "$CREDS_FILE" ``` Equivalent replacement occurs for NetEase credentials: ```bash jq --arg email "$email" \ --arg password "$password" \ '.["163"][$email] = { "password": $password }' "$CREDS_FILE" > "$CREDS_FILE.tmp" mv "$CREDS_FILE.tmp" "$CREDS_FILE" ``` Account removal only removes the account from `config.json`: ```bash CONFIG=$(echo "$CONFIG" | jq --arg email "$email" '.accounts = [.accounts[] | select(.email != $email)]') echo "$CONFIG" > "$CONFIG_FILE" echo "✅ Account removed: $email" ``` ### Technical Analysis `credentials.json` contains Outlook client secrets, refresh tokens, and NetEase application passwords. `load_config` reads the entire file and exports it as `CREDS`, making every subsequently launched child process inherit all configured provider secrets, even when only one account is be ...[truncated 2640 chars]- Remediation
View remediation
"$tmp" chmod 600 "$tmp" mv -f "$tmp" "$CREDS_FILE" ``` Use a cleanup trap to remove temporary files on failure. 4. Set a restrictive umask near the start of every credential-management script: ```bash umask 077 ``` 5. Remove credentials when deleting an account: - Delete `.["163"][$email]` or `.["126"][$email]` for NetEase accounts. - Delete or redesign the global Outlook credential entry when the corresponding Outlook account is removed. - Support separate Outlook credentials per account rather than one global credential object. 6. Prefer an operating-system credential store such as macOS Keychain, Secret Service, or an equivalent secure token store. The README currently claims optional Keychain support, but the audited implementation does not provide it. 7. After migration, rotate existing Outlook refresh tokens and NetEase application passwords that may have remained after account removal. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (62)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill is described as an email-management utility, but the analyzed behavior reportedly also includes uninstall/removal actions, deletion of local configuration, and modification of /usr/local/bin, none of which are disclosed in the description. Undocumented filesystem and installation-path changes are dangerous because they can alter the host environment and remove user data outside the user's reasonable expectations for a mail skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as an email-management utility, but the analyzed behavior reportedly also includes uninstall/removal actions, deletion of local configuration, and modification of /usr/local/bin, none of which are disclosed in the description. Undocumented filesystem and installation-path changes are dangerous because they can alter the host environment and remove user data outside the user's reasonable expectations for a mail skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is described as an email-management utility, but the analyzed behavior reportedly also includes uninstall/removal actions, deletion of local configuration, and modification of /usr/local/bin, none of which are disclosed in the description. Undocumented filesystem and installation-path changes are dangerous because they can alter the host environment and remove user data outside the user's reasonable expectations for a mail skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as an email-management utility, but the analyzed behavior reportedly also includes uninstall/removal actions, deletion of local configuration, and modification of /usr/local/bin, none of which are disclosed in the description. Undocumented filesystem and installation-path changes are dangerous because they can alter the host environment and remove user data outside the user's reasonable expectations for a mail skill.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger matches common words like 邮件, 邮箱, email, 发邮件, 收邮件, and 查邮件, which are broad enough to activate during ordinary conversation about email rather than a clear request to operate on a mailbox. In this context, broad activation is more dangerous because the skill can access private communications and potentially send messages, making accidental invocation a meaningful privacy and action risk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md CONFIG_DIR="$HOME/.onemail" CONFIG_FILE="$CONFIG_DIR/config.json" CREDS_FILE="$CONFIG_DIR/credentials.json" # 日志函数 log() {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md CONFIG_DIR="$HOME/.onemail" CONFIG_FILE="$CONFIG_DIR/config.json" CREDS_FILE="$CONFIG_DIR/credentials.json" # 日志函数 log() {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md CONFIG_DIR="$HOME/.onemail" CONFIG_FILE="$CONFIG_DIR/config.json" CREDS_FILE="$CONFIG_DIR/credentials.json" # 日志函数 log() {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md CONFIG_DIR="$HOME/.onemail" CONFIG_FILE="$CONFIG_DIR/config.json" CREDS_FILE="$CONFIG_DIR/credentials.json" # 日志函数 log() {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md CONFIG_DIR="$HOME/.onemail" CONFIG_FILE="$CONFIG_DIR/config.json" CREDS_FILE="$CONFIG_DIR/credentials.json" # 日志函数 log() {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh CONFIG_DIR="$HOME/.onemail" CONFIG_FILE="$CONFIG_DIR/config.json" CREDS_FILE="$CONFIG_DIR/credentials.json" # 日志函数 log() {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The function accesses high-value OAuth secrets including the client secret and refresh token, then uses them to mint access tokens. In this file, token error handling later prints the full token endpoint response, which can expose bearer tokens or diagnostic secrets to logs or stderr, increasing the risk of credential leakage if output is captured.
- Content
sh local client_secret=$(echo "$creds" | jq -r '.client_secret') local refresh_token=$(echo "$creds" | jq -r '.refresh_token') # 使用 refresh token 获取新的 access token local token_response=$(curl -s -X POST \ "https://login.microsoftonline.com/common/oauth2/v2.0/token" \ -d "client_id=$client_id" \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
When token acquisition fails, the script echoes the full OAuth token response to stderr. OAuth error responses may contain sensitive token material, correlation data, or other secrets; if terminal output, logs, or agent traces are retained, this can leak credentials that enable mailbox access and mail sending.
- Content
sh local new_refresh_token=$(echo "$token_response" | jq -r '.refresh_token') if [ "$access_token" = "null" ]; then echo "❌ 获取 Outlook access token 失败" >&2 echo "$token_response" >&2 exit 1 fi
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This function transmits message content, recipients, and optional attachment contents to Microsoft Graph to send an email, which can materially affect user data and privacy. Aside from an attachment log and error output, there is no explicit user-facing warning or confirmation that outbound email and file contents will be sent to a remote service.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The script is explicitly designed to collect and retain email credentials in a persistent credentials.json file under the user's home directory. In the context of a multi-account email management skill, these secrets grant access to mailbox contents and sending capability; compromise of this file could expose sensitive communications across all configured accounts.
- Content
sh CONFIG_DIR="$HOME/.onemail" CONFIG_FILE="$CONFIG_DIR/config.json" CREDS_FILE="$CONFIG_DIR/credentials.json" echo "🔧 one-mail 初始化配置" echo ""
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh # 删除符号链接 echo "删除符号链接: $INSTALL_DIR/onemail" if [ -w "$INSTALL_DIR" ]; then rm -f "$INSTALL_DIR/onemail" else sudo rm -f "$INSTALL_DIR/onemail" fi
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh # 删除符号链接 echo "删除符号链接: $INSTALL_DIR/onemail" if [ -w "$INSTALL_DIR" ]; then rm -f "$INSTALL_DIR/onemail" else sudo rm -f "$INSTALL_DIR/onemail" fi
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains natural-language statements that the skill documentation and user experience were changed to Chinese and unified in that language. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern unless the constraint is clearly justified or optional.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file describes behaviors that can transmit user data externally, including sending email bodies and attachments to recipients. While usage is documented, there is no explicit warning that these actions send content to external parties or that account-removal operations may be irreversible, which fits the missing-user-warning criterion for markdown files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The cron and auto-reply examples encourage unattended processing of incoming email and automatic outbound responses without emphasizing privacy review, recipient verification, or loop prevention. In an agent/skill context, this can normalize autonomous handling of sensitive communications and lead to accidental disclosure or spam-like behavior.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
- Ensure IMAP/SMTP service is enabled
- Use app-specific password, not login password
- Check if firewall blocks ports 993/465
- IMAP ID Issue: one-mail automatically sends IMAP ID command, complying with NetEase Mail requirements
Test NetEase Mail connection:
bash
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The daily digest example collects unread email metadata and content summaries into a new outbound message, which can leak sensitive business or personal information to another mailbox. Although framed as convenience, it creates an easy path for bulk summarization and retransmission of private communications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The backup and forwarding examples show bulk storage and redistribution of email content but omit warnings about retention, local file protection, and sensitivity of copied messages. Users may adopt these examples directly and inadvertently create plaintext archives or forward confidential information to secondary destinations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example script forwards selected email subject, sender, and snippet to another address automatically, which is a direct data exfiltration pattern. In a multi-account email skill, this is especially risky because it lowers the barrier to silently redistributing potentially sensitive message content across accounts or to third parties.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file describes storing sensitive credentials in
~/.onemail/credentials.jsonand managing multiple email accounts, which implies access to private mailbox contents and outbound transmission of email data. While the README notes storage location and permissions, it does not provide a user-facing warning about the privacy and data-sensitivity implications of using the tool.- Content
Static analysis
No suspicious patterns detected.