Send transactional email via DmartechX/Iemail OpenAPI. Configure in OpenClaw skills env or use secret.md.

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:38 PM UTC
• Version: 1.0.4

Overview

This email-sending skill appears purpose-aligned, but it asks for broader credential-file access than its code needs and can install unpinned Python packages automatically at runtime.

Review this skill before installing. Use it only in an isolated environment with the needed Iemail credentials, avoid letting the agent inspect unrelated config files, and preinstall or pin dependencies instead of allowing runtime pip installs. Do not send sensitive or regulated content through the external email API unless you are authorized to do so.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: send_email.py:9

Finding

Unpinned Third-Party Dependencies Are Installed and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: send_email.py:9-13 and send_email.py:50-53
Vulnerability Type: Runtime installation of unpinned dependencies
Risk Level: Medium

Vulnerable Code

python

try:
    import requests
except ImportError:
    os.system(f"{sys.executable} -m pip install requests -q")
    import requests

python

try:
    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes  # type: ignore
except ImportError:
    os.system(f"{sys.executable} -m pip install cryptography -q")
    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes  # type: ignore

Technical Analysis

When either dependency is unavailable, the Skill invokes pip automatically and installs the latest package version selected by the active package-index configuration. No version constraint, package hash, lockfile, trusted repository restriction, or explicit user approval is applied.

Python package installation can execute package build and installation logic. Consequently, runtime dependency installation introduces a mutable remote supply-chain execution path that is not necessary for the Skill's core email-sending operation. Although the package names shown are legitimate, compromise of the package repository, configured index, dependency chain, network path, or selected package release could cause attacker-controlled code to execute.

The use of os.system does not create a direct command-injection issue here because sys.executable is not derived from a command-line argument. The primary issue is automatic installation and execution of unpinned remote dependencies.

Attack Path

1. The Skill runs in an environment where requests or cryptography is missing.
2. An attacker compromises a selected package release, a transitive dependency, the configured Python package index, or the package-resolution path.
3. The exception handler automatic ...[truncated 956 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all runtime pip install calls from send_email.py.
2. Declare dependencies in a dedicated manifest and lock them to reviewed versions.
3. Require hash verification, such as a fully pinned requirements file installed with pip --require-hashes.
4. Install dependencies during an explicit, trusted deployment phase rather than during Skill execution.
5. Use an isolated virtual environment with only the packages required by this Skill.
6. Configure a trusted package repository and retain dependency provenance or integrity metadata.
7. If a dependency is unavailable at runtime, terminate with a clear error instead of downloading executable code automatically.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:40

Finding

Skill Instructions Request Unnecessary Access to Broad Configuration Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40
Vulnerability Type: Excessive credential and configuration access
Risk Level: Medium

Vulnerable Code

text

1. Credentials: Read `~/.openclaw/openclaw.json` or workspace config files. OpenClaw injects env at runtime.

Technical Analysis

The implementation reads only the dedicated environment variables IEMAIL_ACCESS_KEY, IEMAIL_ACCESS_KEY_SECRET, and IEMAIL_SENDER. It does not need to parse the global OpenClaw configuration or arbitrary workspace configuration files.

Instructing an Agent to read ~/.openclaw/openclaw.json or broadly defined “workspace config files” exceeds the minimum access required for sending email. Those files may contain credentials, endpoints, settings, or tokens belonging to unrelated Skills and services. Loading their contents into Agent context unnecessarily expands the sensitive-data boundary and increases exposure to logging, prompt injection, tool misuse, or later unintended disclosure.

This is an excessive-access instruction rather than evidence that send_email.py directly reads or exfiltrates those files.

Attack Path

1. The Skill is loaded and its instructions are followed.
2. The Agent reads the complete global OpenClaw configuration or workspace configuration files.
3. Credentials and settings unrelated to Iemail enter the Agent's context or tool output.
4. A malicious prompt, compromised tool, subsequent action, or logging path obtains or discloses those unrelated secrets.
5. The exposed credentials may then be used against other services within their assigned privileges.

Impact Assessment

The potential impact extends beyond the declared email functionality. Depending on the contents of the configuration files, exposure could include credentials for unrelated Skills, API services, or workspace integrations.

This instruction does not itself grant new operating-system privileges, but it v ...[truncated 202 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to read ~/.openclaw/openclaw.json or general workspace configuration files.
2. State explicitly that credentials must be supplied only through runtime environment injection.
3. Limit the required environment to IEMAIL_ACCESS_KEY, IEMAIL_ACCESS_KEY_SECRET, and IEMAIL_SENDER.
4. Prevent credentials from being printed, logged, or included in Agent context.
5. If configuration-file support is ever required, use a Skill-specific file containing only the necessary fields and enforce restrictive filesystem permissions.
6. Document that the Agent must not inspect unrelated global or workspace credentials when invoking the Skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The code executes a shell command at runtime to install the requests package if it is missing. Runtime dependency installation expands the skill's behavior beyond email sending, introduces supply-chain risk, and allows execution of external package installation in the current environment without prior approval or integrity controls.

Content

Scanner excerpt · send_email.py (reported line 12)May include surrounding context.

python

try:
    import requests
except ImportError:
    os.system(f"{sys.executable} -m pip install requests -q")
    import requests

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill performs package installation during execution even though its stated purpose is transactional email sending. That behavior is not necessary for normal operation and creates avoidable risk from external code retrieval, dependency confusion, and environment mutation at runtime.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

This shell execution installs cryptography at runtime when the package is absent, again introducing unreviewed code into the execution environment. In a security-sensitive path involving credential-derived signing, on-the-fly package installation increases supply-chain exposure and may permit unexpected code execution under the skill's privileges.

Content

Scanner excerpt · send_email.py (reported line 58)May include surrounding context.

python

try:
        from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes  # type: ignore
    except ImportError:
        os.system(f"{sys.executable} -m pip install cryptography -q")
        from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes  # type: ignore

    encryptor = Cipher(algorithms.AES(key), modes.ECB()).encryptor()

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Installing an additional cryptography package at runtime exceeds the minimum behavior expected from an email-sending skill and adds a second supply-chain entry point. Because this occurs in the authentication/signing path, compromise or unexpected installation behavior could affect credential use and outbound requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to send recipient addresses, subjects, and message bodies through an external email API, but it does not clearly disclose that this data leaves the local environment and is transmitted to a third-party service. This can cause inadvertent sharing of sensitive or regulated data because operators may assume the skill acts only locally or may not consider the privacy, compliance, and consent implications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes meaningful capabilities—shell execution, environment access, and outbound network use—without declaring an explicit tool scope or permissions boundary. That makes it easier for an agent or integrator to invoke the skill with broader authority than users may expect, especially for an action that sends data to an external service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation says the skill should be configured via environment only, but later instructs the agent to read credential-bearing config files. This contradiction is dangerous because agents may follow the more invasive instruction, causing unnecessary secret access and undermining user expectations about how credentials are handled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends recipient addresses and message content to a third-party email provider, but the documentation does not clearly warn users that this data leaves the local environment. For a messaging skill, external transmission is expected, but lack of disclosure can still cause unintended sharing of sensitive or regulated information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims configuration should be provided via injected environment variables, but the agent instructions explicitly tell the agent to read ~/.openclaw/openclaw.json or workspace config files for credentials. This needlessly expands secret exposure by directing the agent to access credential-bearing files, increasing the chance of accidental leakage, misuse, or use of unrelated secrets present in those files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions tell the agent to access credential-bearing configuration files without any warning about secret sensitivity or restrictions on handling those values. This normalizes broad secret access and increases the risk that credentials are exposed in logs, prompts, outputs, or reused outside the intended email action.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Directing the agent to read credential-bearing config files to obtain secrets for execution violates least-privilege principles and creates a clear secret-exposure path. In an agent setting, this is especially risky because the agent may gain access to more credentials than needed, and those secrets can be accidentally disclosed through downstream tool use or generated responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This function reads sensitive credentials from environment variables and uses them to make multiple HTTP requests that transmit recipient, subject, and content data to an external email API. While email sending is the skill's purpose, the code provides no user-facing print/log message, confirmation, or inline warning that environment secrets will be accessed and message content will be sent off-system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.