Mail Sender (Jaskies)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:49 PM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it handles email-sending credentials in ways that deserve review before use.

Review this before installing. Use a dedicated app password with minimal permissions, provide it through a protected environment or secret manager rather than the command line, and consider fixing the script to use a verified SSL context before trusting it with important email credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send.py:12
• Finding: SMTP STARTTLS Does Not Explicitly Enforce Certificate and Hostname Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send.py`, lines 12-14 **Vulnerability Type**: Improper TLS server authentication **Risk Level**: Medium ### Vulnerable Code ```python with smtplib.SMTP(smtp_server, smtp_port) as smtp: smtp.starttls() smtp.login(smtp_user, smtp_pass) ``` ### Technical Analysis The SMTP connection is upgraded with `starttls()` without supplying a hardened `ssl.SSLContext`. This does not explicitly guarantee certificate-chain and hostname verification across supported Python runtimes and configurations. Encryption without reliable server authentication does not prevent an attacker from impersonating the SMTP server. The application subsequently transmits the SMTP username and password through this connection. An attacker capable of intercepting or redirecting network traffic could present an untrusted certificate and impersonate the configured SMTP endpoint where the runtime does not enforce verification. ### Attack Path 1. An attacker obtains a network interception position or manipulates DNS resolution for the configured SMTP hostname. 2. The script connects to the attacker-controlled SMTP endpoint. 3. The endpoint advertises STARTTLS and presents an untrusted or hostname-mismatched certificate. 4. If the active runtime accepts the certificate because verification is not explicitly enforced, the script completes the TLS negotiation. 5. The script calls `smtp.login(smtp_user, smtp_pass)`, disclosing the SMTP credentials to the impersonated endpoint. 6. The attacker may reuse the credentials to access or send email within the permissions granted to the SMTP account. ### Impact Assessment Successful exploitation could disclose the SMTP username, application password, recipient information, subject, and message body. The attacker would obtain the privileges associated with the compromised SMTP credentials, potentially including sending email as the account and any additional mailbox access permitted by ...[truncated 156 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create and pass a verified default TLS context explicitly: ```python import ssl context = ssl.create_default_context() with smtplib.SMTP(smtp_server, smtp_port, timeout=30) as smtp: smtp.ehlo() smtp.starttls(context=context) smtp.ehlo() smtp.login(smtp_user, smtp_pass) smtp.send_message(msg) ``` Keep `check_hostname` enabled and `verify_mode` set to `ssl.CERT_REQUIRED`. Do not use unverified contexts or suppress certificate errors. Consider restricting the allowed SMTP server to an approved hostname and adding a connection timeout to limit hangs against hostile endpoints. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send.py:25
• Finding: SMTP Password Can Be Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send.py`, line 25 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument("--smtp-pass", default=os.getenv("SMTP_PASS"), help="SMTP password") ``` ### Technical Analysis The script permits the SMTP password to be supplied directly through the `--smtp-pass` command-line option. Command-line arguments may be visible in process listings, process-monitoring systems, shell command history, diagnostic output, job metadata, and execution logs. Although the environment-variable fallback is safer than a command-line argument in some environments, accepting the password as an argument creates a direct and avoidable credential-disclosure channel. ### Attack Path 1. A user launches the script with `--smtp-pass <secret>`. 2. The secret becomes part of the process argument vector and may also be recorded in shell history or automation logs. 3. Another local user, monitoring agent, administrator, or log reader retrieves the argument while the process is running or from retained history. 4. The observer reuses the SMTP credential to authenticate to the configured mail service. 5. The attacker performs actions allowed by the compromised account, such as sending impersonated messages. ### Impact Assessment Successful exploitation discloses the SMTP password to an actor with access to process metadata, shell history, or execution logs. The resulting privileges are limited to those granted by the SMTP credential, but may include sending messages as the account owner and, depending on provider configuration, broader access to the associated email account. This could enable impersonation, phishing, spam distribution, and reputational harm. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Remove the `--smtp-pass` command-line option. Retrieve the credential from a dedicated secret manager, protected environment injection, or an interactive prompt that does not echo input. For interactive use: ```python import getpass smtp_pass = os.getenv("SMTP_PASS") if not smtp_pass: smtp_pass = getpass.getpass("SMTP password: ") ``` For automated use, inject the secret through the execution platform's secret-management facility and restrict access to the process environment. Ensure logs never print the password, disable shell tracing around secret handling, and rotate any credential previously supplied through command-line arguments. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill requires access to sensitive environment-based SMTP credentials (`SMTP_USER`/`SMTP_PASS`) but does not declare any explicit tool scope or permission boundary. That omission can cause the runtime or user to grant broader-than-necessary access implicitly, reducing transparency around secret use and increasing the chance of credential exposure or misuse.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file content is entirely written in Vietnamese and directly addresses the user in that language, with no indication that other languages are supported or that Vietnamese is required for a region-specific purpose. This creates a natural-language locale policy issue because the skill implicitly enforces a specific language without user opt-in.

Static analysis

No suspicious patterns detected.