Security audit
Security checks for vulnerabilities and agentic risk
This SMTP skill is coherent and safety-scoped: it supports email testing and sending with explicit confirmation, local notes, and secret-handling warnings.
Install only if you are comfortable letting the agent help test or send SMTP mail. Use approved canary inboxes first, confirm every live send, provide credentials only through a trusted runtime secret source, and keep ~/smtp notes free of passwords, tokens, private keys, full recipient lists, and full message bodies unless truly necessary.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
# Send Flow - SMTP
Use this workflow for every SMTP task so the agent does not skip safety gates.
## Step 1: Classify the job
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- guess live-send approval from vague user intent
- keep credentials in `~/smtp/`
- treat queue acceptance as the final delivery result
- broaden a one-off test into a bulk-send workflow without consent
## Related Skills
Install with `clawhub install <slug>` if user confirms:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/smtp
touch ~/smtp/{memory.md,provider-profiles.md,send-log.md,deliverability-notes.md}
chmod 700 ~/smtp
chmod 600 ~/smtp/{memory.md,provider-profiles.md,send-log.md,deliverability-notes.md}
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/smtp touch ~/smtp/{memory.md,provider-profiles.md,send-log.md,deliverability-notes.md} chmod 700 ~/smtp chmod 600 ~/smtp/{memory.md,provider-profiles.md,send-log.md,deliverability-notes.md}
If the files are empty:
The template directs creation of a persistent SMTP memory file containing operational details like provider/host names, sender-domain control, safe canary inboxes, and known-good auth/TLS combinations, but it does not warn against storing secrets such as SMTP passwords, API keys, or full recipient data. In an email infrastructure context, users may reasonably over-collect sensitive configuration material in this file, increasing the risk of credential exposure or leakage of internal mail-routing information.
No suspicious patterns detected.