Mail Sender SMTP

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:01 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward SMTP email sender, but users should avoid passing the SMTP password on the command line.

Install only if you are comfortable giving the agent access to an SMTP app password for sending email. Prefer SMTP_PASS as a protected environment variable or secret manager entry, avoid --smtp-pass on the command line, use a provider-specific app password with limited scope, and rotate any password previously pasted into shell history or conversation logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send.py:23

Finding

SMTP Password Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/send.py, line 23
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

parser.add_argument("--smtp-pass", default=os.getenv("SMTP_PASS"), help="SMTP password")

Technical Analysis

The script permits an SMTP password to be supplied through the --smtp-pass command-line argument. Command-line arguments are not an appropriate secret-transport mechanism because they may be:

• Stored in shell history.
• Captured by command auditing or process-monitoring systems.
• Visible in process metadata to local users or services, subject to operating-system access controls.
• Recorded in automation logs, diagnostic output, or job definitions.

Although the environment-variable default provides a safer alternative in some deployment contexts, the exposed command-line interface explicitly supports unsafe credential handling. The error message at line 35 also directs users to provide missing configuration through “environment variables or arguments,” potentially encouraging this behavior.

Attack Path

1. A user invokes the script with a plaintext credential, for example:

   bash

   python3 scripts/send.py \
     --smtp-server smtp.example.com \
     --smtp-user [e-mail] \
     --smtp-pass 'SECRET' \
     --to-email [e-mail] \
     --subject Test \
     --body Message
   

2. The password becomes part of the process argument vector and may also be retained in shell history or execution logs.
3. A local attacker, monitoring service, log reader, or other party with suitable access retrieves the exposed argument.
4. The attacker authenticates to the configured SMTP service using the recovered credential.
5. The attacker sends unauthorized messages or performs any additional operations permitted by that SMTP account.

Exploitation requires access to pro ...[truncated 682 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --smtp-pass command-line option so secrets cannot be supplied through process arguments.
2. Retrieve the password from a protected secret manager or, where appropriate, the SMTP_PASS environment variable.
3. For interactive execution, use getpass.getpass() to accept the password without displaying or persisting it in shell history.
4. Update the error message at line 35 so it does not recommend supplying the password through arguments.
5. Ensure automation platforms mask the secret, restrict access to job configuration and logs, and avoid printing environment contents.
6. Use provider-specific, narrowly scoped app passwords rather than primary account credentials, and rotate any credential previously passed on the command line.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill references sensitive SMTP credentials via environment variables but does not declare any explicit tool scope or permissions boundary. That makes the capability to access secrets implicit rather than constrained, which can lead to over-privileged execution or unintended secret exposure in agent environments that rely on manifest-level scoping.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code accepts and uses SMTP credentials, including a password from environment variables or command-line arguments, but provides no warning in comments, help text, or other user-facing disclosure about handling sensitive credentials. Under the code-file criteria, access to sensitive environment variables or credentials should have some visible disclosure.

Content

No source excerpt is available for this finding.