Security audit

IMAP

Security checks for vulnerabilities and agentic risk

Overview

This IMAP skill is clearly focused on mailbox search, fetch, sync, and safe state handling, with sensitive email access disclosed and bounded to the user-configured mail server.

Install this only for mailboxes and credential flows you already trust. Expect it to contact your configured IMAP server and, when needed, fetch message metadata, bodies, or attachments. Review or disable ~/imap/ persistence if you do not want account labels, folder mappings, sync checkpoints, or mailbox workflow preferences remembered locally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
### 7. Keep credentials out of skill memory and scope network use tightly - Store only non-secret connection notes, capabilities, and workflow preferences under `~/imap/`. - Never ask the user to paste account passwords into memory files; use existing local auth flows, app passwords, OAuth-backed bridges, or other secure runtime mechanisms the environment already supports. - Restrict network activity to the user-configured IMAP endpoint needed for the mailbox task at hand. ## IMAP Traps

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
## IMAP Traps - Treating message sequence numbers as stable identifiers -> follow-up fetches hit the wrong message after mailbox changes. - Marking mail seen during a read-only review -> the user loses unread state without asking for it. - Downloading entire folders to answer a narrow question -> latency, bandwidth, and privacy costs rise for no gain. - Ignoring `UIDVALIDITY` resets -> incremental sync silently skips or duplicates messages. - Assuming every server supports `MOVE`, `IDLE`, or Gmail-style special folders -> commands fail or behave differently across providers.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
- Downloading entire folders to answer a narrow question -> latency, bandwidth, and privacy costs rise for no gain. - Ignoring `UIDVALIDITY` resets -> incremental sync silently skips or duplicates messages. - Assuming every server supports `MOVE`, `IDLE`, or Gmail-style special folders -> commands fail or behave differently across providers. - Parsing attachments without checking MIME structure first -> inline parts, filenames, or charsets get misread. ## External Endpoints

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template leaves activation criteria undefined and even suggests a broad automatic trigger scope for mailbox search, triage, and sync debugging. In an email-handling skill, overly broad activation can cause the agent to engage on loosely related prompts and access mailbox data when the user did not clearly intend to invoke IMAP capabilities, increasing the risk of unintended data exposure or mailbox-side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file instructs use of 'complete RFC822 source' and 'attachment download', which can expose sensitive personal or organizational data. The skill description does not include any warning or caution to the user about inspecting or retrieving potentially sensitive mailbox content before escalating to full-content fetches.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup text directs broad proactive activation for topics like IMAP, mailbox sync, unread triage, or remote inbox search, which can cause the skill to engage in ordinary email-related conversations without a clear explicit user request. In a mailbox tool, this matters because premature activation can steer the agent into handling sensitive mailbox operations or collecting account context earlier than the user intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instructions say to create ~/imap/ and initialize persistent files when memory is enabled, but they do not require a clear user-facing notice or consent before writing to local storage. Even though the content limits what should be stored, silent persistence of mailbox metadata and preferences can violate user expectations and create privacy or forensic exposure on the local system.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.