Inbox Triage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

This inbox helper is not clearly malicious, but it handles private messages with weak privacy guidance and has triage rules that can downplay security alerts.

Review this skill before installing. It may be useful for local inbox triage, but only run it on message exports you intentionally provide, avoid sensitive or regulated conversations unless you understand where outputs are stored, pin or verify the installer, and manually review all account-security, login, password, verification, and recovery messages instead of trusting the generated priority labels.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned npx Package Execution Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-14; also present at README.md:7-9
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:12-14:

bash

# Install the skill
npx clawhub install inbox-triage

README.md:7-9:

bash

# Install via clawhub
npx clawhub install inbox-triage

Technical Analysis

The installation instructions invoke clawhub through npx without specifying an exact package version, package integrity digest, or trusted registry configuration. If the package is not already installed locally, npx may download and execute the version currently resolved by the configured npm registry.

The code executed during installation can therefore change independently of the reviewed Skill. Compromise of the package publisher, registry account, package name, or dependency graph could cause installation-time code to differ from the audited artifact.

This finding does not establish that the current clawhub package is malicious. The vulnerability is the absence of dependency pinning and integrity verification before execution.

Attack Path

1. An attacker compromises the package publisher, registry account, or another component involved in resolving the clawhub package.
2. The attacker publishes a malicious package version or modifies a dependency used during installation.
3. A user follows the documented Quick Start command.
4. npx resolves and downloads the attacker-controlled version.
5. Package lifecycle or CLI code executes with the privileges of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting access could include files, credentials, environment variables, and network resources available to that account. The command does not itself request elevated privileges, so the direct priv ...[truncated 59 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer to an exact audited version, rather than allowing npx to resolve the latest available release.
• Commit and verify a lockfile where the installation workflow supports one.
• Use registry-provided integrity hashes or signed release artifacts.
• Document the expected package registry and reject unexpected registry overrides.
• Prefer a separately installed and verified CLI over downloading executable code as part of a one-line Skill installation command.
• Add release procedures that re-audit the exact pinned package whenever the version changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/triage.py:198

Finding

Attacker-Controlled Message Fields Are Written to Markdown Without Escaping

Content

View full analysis

Vulnerability Details

File Location: scripts/triage.py:198-205
Vulnerability Type: Markdown content injection
Risk Level: Medium

Vulnerable Code

python

for msg in results["urgent"]:
    lines.append(f"  - {msg['subject'][:50]}... from {msg['sender']}")

lines.append("")
lines.append(f"🟡 **NORMAL** ({len(results['normal'])}):")

for msg in results["normal"]:
    lines.append(f"  - {msg['subject'][:50]}... from {msg['sender']}")

Technical Analysis

The message subject and sender originate from the input JSON and are inserted directly into Markdown output. The implementation does not escape Markdown metacharacters, remove line breaks, or reject inline HTML.

Limiting the subject to 50 characters does not make it safe. The sender is not truncated at all, and either field can contain formatting syntax, links, image references, headings, or additional list entries. The resulting behavior depends on the Markdown renderer. In permissive renderers, inline HTML or remote image syntax may cause more significant effects such as misleading presentation or external resource requests.

Attack Path

1. An attacker sends or supplies a message whose subject or sender contains crafted Markdown, line breaks, or inline HTML.
2. The message is included in the JSON processed by triage.py.
3. generate_digest() interpolates the malicious field into the digest without encoding.
4. The victim opens the generated digest in a Markdown renderer.
5. The injected content is rendered as attacker-selected formatting, links, additional digest entries, or potentially remote resources, depending on renderer capabilities.

Impact Assessment

Exploitation can alter the visual integrity of the digest, disguise message priority, inject deceptive links, or make attacker-created content appear to be trusted output from the Skill. A renderer that automatically loads remote resources may also disclose the viewer's ...[truncated 235 chars]

Remediation

View remediation

Remediation Suggestions

• Escape Markdown control characters in all untrusted fields before interpolation.
• Remove or normalize carriage returns and line feeds so one message cannot create additional digest entries.
• Strip inline HTML or use a Markdown renderer configured to disable raw HTML.
• Disable automatic loading of remote images and other external resources in the recommended viewing workflow.
• Consider generating a structured JSON document first and using a security-reviewed template engine with contextual output encoding.
• Add tests containing brackets, parentheses, image syntax, headings, inline HTML, and embedded newlines in both subject and sender.

other

Warning

• Location: config.yaml:45

Finding

Account-Compromise Notifications Can Be Downgraded as Spam or Normal Messages

Content

View full analysis

Vulnerability Details

File Location: config.yaml:45-52; scoring implementation at scripts/triage.py:109-129
Vulnerability Type: Security alert misclassification
Risk Level: Medium

Vulnerable Code

config.yaml:45-52:

yaml

# Notification patterns (usually low priority)
notification_patterns:
  - "password"
  - "login"
  - "verification"
  - "security alert"
  - "account update"

scripts/triage.py:109-129:

python

# Score for spam
spam_score = 0
for keyword in self.config["rules"]["spam_keywords"]:
    if keyword in content_lower:
        spam_score += self.weights["spam_keywords"]

# Score for notifications (usually spam)
notification_score = 0
for pattern in self.config["rules"]["notification_patterns"]:
    if re.search(pattern, content_lower, re.IGNORECASE):
        notification_score += self.weights["notification_patterns"]

total = urgent_score + question_score + spam_score + notification_score

if total == 0:
    return "unknown"

# Normalize scores
urg_pct = (urgent_score + question_score) / total
spam_pct = (spam_score + notification_score) / total

if urg_pct > 0.7:
    return "urgent"
elif spam_pct > 0.7:
    return "spam"
else:
    return "normal"

The bundled fixture demonstrates the behavior. test_messages.json:20-25 contains:

json

{
  "content": "Your password was changed. If this wasn't you, contact support immediately.",
  "sender": "Security Alert",
  "timestamp": "2026-04-15T07:45:00Z",
  "subject": "Password Changed"
}

The generated result at triage_test.md:8-12 places that message under NORMAL:

markdown

🟡 **NORMAL** (4):
  - Good work!... from Team Lead
  - Special Sale Inside... from Store Newsletter
  - Password Changed... from Security Alert
  - Meeting Today at 3PM... from Calendar Bot

Technical Analysis

Password changes, suspicious logins, verification e ...[truncated 1727 chars]

Remediation

View remediation

Remediation Suggestions

• Introduce a dedicated high-priority security category for password changes, new-device logins, recovery changes, multi-factor authentication events, and suspected compromise warnings.
• Ensure explicit compromise phrases override promotional and generic notification scores.
• Do not treat password, login, verification, or security alert as spam indicators without additional context.
• Use sender authentication and source reputation where reliable metadata is available, while avoiding trust based solely on the displayed sender name.
• Require human review for all account-security notifications and never generate casual acknowledgment drafts for them.
• Add regression tests asserting that the bundled password-change fixture is classified as urgent.
• Add adversarial tests for mixed phrases such as “security alert,” “immediately,” “new login,” and “if this was not you.”
• Replace the strict ratio-only fallback with explicit precedence rules for high-consequence security events.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is explicitly designed to process private communications from sources like Signal and Telegram, generate summaries, and draft replies, but the README provides no warning about handling sensitive or regulated data. This increases the risk that users will feed confidential messages into the tool without understanding retention, exposure, or downstream sharing risks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to execute npx clawhub without pinning a specific package version, which can cause installation or execution of whatever version is currently published. If the package or a dependency is compromised, users following the documentation could run attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to execute npx clawhub install inbox-triage without pinning a specific version. This creates a supply-chain risk because users may fetch whatever version is current at execution time, including a compromised or maliciously updated package.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase Help me triage my inbox is broad natural language that overlaps with ordinary conversation. Overly generic triggers can cause unintended activation, leading the skill to access or process sensitive inbox data when the user did not explicitly intend to invoke it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes collecting messages from Signal, Telegram, Discord, and email but does not give a clear upfront privacy warning about ingesting sensitive third-party communications. Users may unknowingly expose personal, confidential, or regulated data to the skill’s processing pipeline.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

2. **Analyze**: Parse content, sender, timestamps, and context
3. **Categorize**: Apply priority rules and classification logic
4. **Summarize**: Generate digest or alert summaries
5. **Draft**: Create response options for review

### Configuration

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

- **Accuracy**: Categorization is probabilistic, not perfect
- **Context**: May miss nuanced context in messages
- **Human review required**: Never auto-send without approval
- **Platform support**: Works best with text-based channels (Signal, Telegram, Discord, email)

## Iteration

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The question_patterns list is broad and includes common phrases such as "can you" and "do you think," which are likely to appear in ordinary conversations unrelated to urgency. In an inbox triage context, this can cause systematic misclassification of routine messages as urgent, leading to alert fatigue, missed prioritization, or inappropriate downstream handling.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The configuration explicitly allows certain messages to be auto-approved without human review. Even though the listed examples seem low risk, simple keyword-based auto-approval can be abused by crafting messages that mimic those patterns, causing important or malicious content to bypass manual triage.

Content

Scanner excerpt · config.yaml (reported line 60)May include surrounding context.

yaml

- "Thanks for the update. I'll take a look and respond by EOD."
    - "Got it! I'll follow up once I've reviewed this."
  
  auto_approve:
    # Messages that can auto-approve without review
    - "meeting reminder"
    - "calendar notification"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

This finding reflects the same risky behavior: autonomous approval decisions are made from minimal pattern matching with no visible safeguards. In a messaging triage skill, that increases the chance that spoofed or ambiguous messages are silently accepted and excluded from appropriate scrutiny.

Content

Scanner excerpt · config.yaml (reported line 61)May include surrounding context.

yaml

- "Got it! I'll follow up once I've reviewed this."
  
  auto_approve:
    # Messages that can auto-approve without review
    - "meeting reminder"
    - "calendar notification"
    - "system update"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document defines urgent classification using multiple categories including question patterns, known contacts, and time anchors, but the example code only scores four urgent keywords: asap, urgent, deadline, and immediately. Because the code contradicts the stated algorithmic rules by omitting the documented criteria, the documentation overstates what the implementation does.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Broad urgent triggers like common requests and confirmation phrases can be exploited to force ordinary or malicious messages into a high-priority queue. In a messaging triage skill, this increases the chance of phishing, spam, or low-value content bypassing normal attention filters and receiving expedited human review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Ambiguous time anchors such as 'tomorrow,' 'this week,' or 'by Friday' appear frequently in normal planning and can be abused to inflate urgency scores. In this skill context, attackers or noisy senders can craft innocuous-looking messages that receive disproportionate priority, reducing the reliability of the triage system and increasing attention theft risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document states that spam classification uses promotional keywords such as "discount", "subscribe", "free trial", and related phrases, but the example code only matches the regex \b(discoun|sale|promo)\b. This actively diverges from the documented rule set and would fail to implement several listed patterns while also using an apparent truncated token (discoun) not described in the documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code loads potentially sensitive message content from the user-provided input file and also reads local configuration and correction-history files under the user's home directory. While the script has basic docstrings and one output message, it does not visibly disclose that it will process inbox contents and local history data, which is a privacy-relevant operation for an inbox triage tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The text says "Incremental learning updates priority weights based on correction patterns," which describes active adaptive behavior. However, the file only includes a sample corrections YAML entry and no code or mechanism that updates weights from those corrections, creating an intent-versus-implementation mismatch within the document.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.