ClawHub
Back to skill

Security audit

LobsterMail

Security checks for vulnerabilities and agentic risk

Overview

The skill's email features are coherent, but its installation and daily update instructions can replace local agent instructions and run unpinned remote code.

Review before installing. Avoid the curl|sh installer, pin and verify npm/MCP package versions, and do not allow automatic skill or SDK updates without inspecting the diff. Use the email features only with clear user approval for signups, verification codes, outbound messages, billing checkout, and any content that may contain personal or account data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:10
Finding

Mutable Remote Installer Is Executed Directly by a Shell

Content
View full analysis

Vulnerability Details

File Location: README.md, line 10
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -sL https://api.lobstermail.ai/install | sh

Technical Analysis

The installation command downloads content from a mutable remote endpoint and passes it directly to sh. The response is executed without displaying it for review, pinning it to an audited version, validating a checksum, or verifying a cryptographic signature.

The installer returned by /install is not included in the audited project, so its behavior and required privileges cannot be statically verified. Although installing the Skill is related to the declared functionality, arbitrary shell execution is broader than the minimum privilege required to copy a Skill definition into the OpenClaw skills directory.

HTTPS protects transport under ordinary conditions, but it does not protect against compromise of the service, deployment pipeline, CDN, DNS infrastructure, TLS credentials, or maintainer account. Because the endpoint is mutable, the effective installer can also change after this project has been reviewed.

Attack Path

  1. An attacker compromises the LobsterMail installer endpoint or an associated deployment or distribution component.
  2. The attacker changes the endpoint response to include malicious shell commands.
  3. A user follows the documented installation command.
  4. curl retrieves the modified response and immediately streams it into sh.
  5. The malicious commands execute with all permissions available to the invoking user, without a separate review or confirmation step.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The payload could read or modify user-accessible files, steal credentials and API tokens, alter OpenClaw configuration, install persistence, replace other Skill ...[truncated 341 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | sh installation pattern.
  • Publish a versioned installer or Skill artifact through a controlled release process.
  • Require users to download the artifact as a separate step before execution.
  • Publish and require verification of a SHA-256 digest and, preferably, a signature tied to a documented release key.
  • Pin installation instructions to an immutable version rather than a mutable endpoint.
  • Include the installer source in the repository so its behavior can be reviewed.
  • Ensure the installer operates without elevated privileges and only writes to the required Skill directory.
  • Use strict shell settings and explicit validation if a shell installer remains necessary.

T08 · Insecure Dependencies

Error
Location
SKILL.md:31
Finding

Unpinned npm Packages Can Download and Execute Unreviewed Dependency Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-42
Vulnerability Type: Insecure dependency installation and execution
Risk Level: High

Vulnerable Code:

json
{
  "mcpServers": {
    "lobstermail": {
      "command": "npx",
      "args": ["@lobstermail/mcp"]
    }
  }
}
bash
npm install lobstermail

Technical Analysis

Both packages are referenced without exact versions or independently verified integrity metadata. Depending on local npm behavior and cache state, npx @lobstermail/mcp can retrieve and execute the currently resolved registry release. Similarly, npm install lobstermail retrieves a mutable package version and may execute npm lifecycle scripts during installation.

This makes the code that runs locally dependent on the package registry's current state rather than the audited Skill content. A compromised publisher account, malicious package release, registry compromise, or compromised transitive dependency could introduce arbitrary code after the Skill itself has been approved.

Executing an MCP server requires local code execution, but automatically resolving an unpinned package is not the least-privilege or least-trust method of providing that functionality.

Attack Path

  1. An attacker compromises a relevant npm publisher account, package release process, registry entry, or transitive dependency.
  2. The attacker publishes a malicious version under the expected package name.
  3. A user or agent follows the Skill instructions without an existing trusted pinned installation.
  4. npm resolves and downloads the attacker-controlled release.
  5. Malicious lifecycle code runs during installation, or the malicious MCP package runs when npx starts the server.
  6. The package gains the permissions and environment access of the OpenClaw or terminal process.

Impact Assessment

A malicious dependency could execute arbitrary code under the curren ...[truncated 494 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every package to an exact reviewed version instead of relying on a registry's current resolution.
  • Avoid using bare npx commands that can download code implicitly.
  • Install dependencies through a reviewed manifest and committed lockfile, then use npm ci.
  • Verify npm integrity and provenance information before installation.
  • Disable lifecycle scripts with --ignore-scripts unless specific reviewed scripts are required.
  • Require explicit user approval before an agent installs or updates executable dependencies.
  • Review and pin transitive dependencies as part of the release process.
  • Run the MCP server in a restricted environment with minimal filesystem, credential, and network access.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:84
Finding

Daily Heartbeat Can Replace Trusted Skill Instructions with Mutable Remote Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84-95
Vulnerability Type: Remote Skill replacement and unsafe automatic updates
Risk Level: High

Vulnerable Code:

bash
npm outdated lobstermail
bash
npm install lobstermail@latest
bash
curl -sL https://api.lobstermail.ai/skill | head -5
bash
curl -sL https://api.lobstermail.ai/skill -o ~/.openclaw/skills/lobstermail/SKILL.md

Technical Analysis

The heartbeat instructs the agent to check for updates daily, install the moving latest SDK release, and overwrite the locally loaded Skill definition with content from a mutable remote endpoint. No checksum, signature, trusted-version allowlist, content diff, or mandatory user approval is required.

SKILL.md controls how an agent uses tools and interprets tasks. Replacing it with unaudited remote content can therefore change future agent behavior after the original Skill has passed review. This is more security-sensitive than an ordinary documentation update because altered Skill instructions may direct tool calls, dependency execution, network access, or handling of sensitive email and account information.

The direct overwrite also creates persistent cross-session effects because the modified file remains in the user's Skill directory and can be loaded by later sessions. The associated @latest dependency update compounds the risk by introducing mutable executable code.

Attack Path

  1. An attacker compromises api.lobstermail.ai, its deployment pipeline, or another component capable of changing the /skill response or npm release.
  2. The attacker publishes a modified Skill containing hostile agent instructions, or publishes a malicious latest SDK release.
  3. The daily heartbeat detects a purported update.
  4. The agent downloads the remote Skill directly over the trusted local copy and/or installs the moving latest package.
  5. OpenClaw loads the ...[truncated 800 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove automatic Skill replacement and automatic installation of @latest.
  • Publish immutable, versioned Skill and SDK releases.
  • Sign release artifacts and verify signatures against a pinned trusted key before applying updates.
  • Publish expected cryptographic hashes through a channel separate from the artifact host.
  • Download updates to a staging path, display a semantic diff, and require explicit user approval before replacement.
  • Restrict accepted updates to an administrator-approved version allowlist.
  • Preserve the previous trusted version and provide a rollback mechanism.
  • Separate update discovery from update installation; a heartbeat may notify the user but should not modify executable dependencies or agent instructions.
  • Apply restrictive filesystem permissions to the local Skill directory so ordinary Skill execution cannot silently rewrite trusted definitions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

curl -sL https://api.lobstermail.ai/install | sh is a classic unsafe install pattern because it fetches executable content at runtime from a remote endpoint and immediately executes it with shell privileges. In the context of an agent skill, this could lead to arbitrary code execution, persistence in the agent's skills directory, or silent environment tampering if the endpoint or delivery chain is compromised.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | sh chaining removes the user's opportunity to inspect downloaded content and turns any compromise of the remote server, CDN, TLS termination, or upstream build pipeline into immediate command execution. Because the skill is meant to integrate with an AI agent environment, successful abuse could expand from initial code execution into persistent agent manipulation or credential access.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README instructs users to pipe a remotely fetched script directly into sh, which executes unreviewed code from the network immediately. In a skill context, this is especially dangerous because installation code can modify the local agent environment, add persistence, or install additional components without any verification step.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

One-liner — downloads the skill from the edge proxy and saves it to your OpenClaw skills directory:

bash
curl -sL https://api.lobstermail.ai/install | sh

Restart OpenClaw (or start a new session). The skill loads automatically.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

If you're working on the skill itself, you can symlink it instead:

bash
mkdir -p ~/.openclaw/skills
ln -s "$(pwd)/packages/claw-skill" ~/.openclaw/skills/lobstermail

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README describes automatic account provisioning and token persistence as part of normal use but does not clearly warn users before they trigger these behaviors. This matters because the skill handles real email identities and stores an authentication token locally, creating privacy and credential-management risk if users or agents invoke it without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/lobstermail
curl -sL https://api.lobstermail.ai/skill -o ~/.openclaw/skills/lobstermail/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/lobstermail
curl -sL https://api.lobstermail.ai/skill -o ~/.openclaw/skills/lobstermail/SKILL.md

Or just read it from the URL above!

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/lobstermail
curl -sL https://api.lobstermail.ai/skill -o ~/.openclaw/skills/lobstermail/SKILL.md

Or just read it from the URL above!

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This instruction downloads remote content directly into the local skill path, enabling unreviewed remote updates to persist and influence future agent actions. In skill context, this is more dangerous because skill files define agent behavior, so tampering or compromise of the remote endpoint becomes a supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

text
   Compare the `version:` in the frontmatter with your local copy. If newer, re-download:
   ```bash
   curl -sL https://api.lobstermail.ai/skill -o ~/.openclaw/skills/lobstermail/SKILL.md
  1. Check inbox health:

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This instruction downloads remote content directly into the local skill path, enabling unreviewed remote updates to persist and influence future agent actions. In skill context, this is more dangerous because skill files define agent behavior, so tampering or compromise of the remote endpoint becomes a supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

text
   Compare the `version:` in the frontmatter with your local copy. If newer, re-download:
   ```bash
   curl -sL https://api.lobstermail.ai/skill -o ~/.openclaw/skills/lobstermail/SKILL.md
  1. Check inbox health:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill encourages using generated email addresses for user-related signups, confirmations, and monitoring without any consent, privacy, or account-ownership warning. In practice, this can lead agents to create or use third-party inboxes for user workflows without clear authorization or notice about where sensitive messages will be stored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents outbound email sending plus verification and billing flows, including adding a credit card, without a prominent warning that these are external actions with privacy and financial consequences. An agent following these instructions could trigger account upgrades, payment setup, or send messages on a user's behalf without sufficiently explicit user confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill provides an outbound email API call that can send external communications, but the surrounding documentation does not consistently require explicit user confirmation before sending. In agent contexts, external messaging is sensitive because it can leak data, impersonate the user, or create real-world effects.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

REST equivalent:

bash
curl -X POST https://api.lobstermail.ai/v1/emails/send \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"from": "INBOX_ID", "to": ["someone@example.com"], "subject": "Hello", "body": {"text": "Message body"}}'