ClawHub
Back to skill

Security audit

msmtp-send

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can send email from the user's configured account without a built-in confirmation step or strong credential-handling guidance.

Install only if you are comfortable letting the agent send plain-text email through your local msmtp account. Use it for trusted recipients and intentional short messages, harden ~/.msmtprc permissions, and avoid sending sensitive content unless you have reviewed the recipient, subject, and body first.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
msmtprc.md:2
Finding

Plaintext SMTP Application Password Storage Without Required File-Permission Hardening

Content
View full analysis

Vulnerability Details

File Location: msmtprc.md, lines 2 and 13
Vulnerability Type: Plaintext credential storage and insecure configuration guidance
Risk Level: Medium

Vulnerable Code

text
# Fill out your details and place this file in ~/.msmtprc
text
password        abcd efgh ijkl mnop 	# Use the password from https://myaccount.google.com/apppasswords

Technical Analysis

The configuration template directs users to replace a placeholder with a Gmail application password and store it directly in ~/.msmtprc. Storing an authentication secret in plaintext creates a credential-exposure risk. The documentation also does not require restrictive permissions such as mode 0600 or verify that the file is owned by the intended user.

Consequently, a real application password may become accessible through permissive file permissions, local access by another account, insecure backups, or accidental inclusion in version control. This finding concerns the documented credential-handling pattern; the audited template itself contains only a placeholder, not a confirmed live credential.

Attack Path

  1. A user copies the template to ~/.msmtprc.
  2. The user replaces the sample value with a valid Gmail application password.
  3. The file remains readable by unintended local users, is copied into an insecure backup, or is accidentally committed to a repository.
  4. An attacker obtains the plaintext application password from the exposed file or copy.
  5. The attacker authenticates to Gmail's SMTP service using the compromised account and application password.
  6. The attacker sends unauthorized email within the permissions and restrictions associated with that application password.

Impact Assessment

Successful exploitation can disclose the configured Gmail application's SMTP credential. An attacker may send email as the affected account, enabling impersonation, spam, phishing, reputational ...[truncated 396 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer retrieving the password from an operating-system keyring or dedicated secret manager through msmtp's passwordeval directive instead of embedding it in the configuration file.
  2. If file-based storage is unavoidable, explicitly require restrictive ownership and permissions:
    bash
    chown "$USER":"$(id -gn)" ~/.msmtprc
chmod 600 ~/.msmtprc
  3. Add setup-time validation that rejects configuration files readable or writable by group or other users.
  4. Clearly identify the displayed password as a non-secret placeholder and warn users never to commit a populated .msmtprc to version control.
  5. Exclude credential-bearing configuration files from backups unless the backups are encrypted and access-controlled.
  6. Rotate the Gmail application password immediately if the populated file is exposed, committed, or copied to an untrusted location.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description does not clearly warn users that recipient addresses and message contents will be transmitted using the host's configured email account in ~/.msmtprc. Without an explicit disclosure, users may not understand that sensitive content could leave the system and be sent from their personal or organizational mailbox.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill says it will 'automatically dispatch' to the exec tool, but the invocation details are incomplete and broad enough that an agent could trigger email sending without sufficiently explicit user confirmation or constrained parameters. Because this skill causes external transmission of data to recipients via local mail configuration, ambiguous triggering increases the risk of unintended disclosure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script sends email immediately using the local msmtp configuration with no confirmation prompt, disclosure, dry-run mode, or audit cue to the user. In an agent setting, this creates a meaningful risk of unintended or unauthorized outbound data exfiltration because any caller that can invoke the skill can transmit arbitrary content to external recipients.

Content

No source excerpt is available for this finding.