Security audit

Apple Mail Channel Setup

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for Apple Mail setup, but it deserves review because its examples enable broad mailbox automation and all-sender email processing without strong safety warnings.

Review before installing. Use a dedicated or least-privileged mailbox where possible, avoid allowFrom ["*"] unless you intentionally want any sender to reach the agent, require manual approval before replies or archiving, and pin or verify the external Apple Mail plugin before granting macOS Automation access.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:38
Finding: Wildcard sender allowlist exposes the AI agent to untrusted email instructions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned third-party plugin installation creates supply-chain exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README promotes monitoring, filtering, replying to, and auto-archiving Apple Mail messages but does not clearly warn that the skill/plugin will access potentially sensitive mailbox contents and may take actions on a user’s behalf. In a mail-integration context, missing privacy and consent guidance can lead users to over-broaden access (for example, using permissive allowlists) or enable automated handling on personal or work accounts without understanding the exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation explicitly recommends or normalizes allowFrom: ["*"], which permits processing email from any sender, but does not pair that guidance with a clear warning about spam, phishing, prompt injection, and malicious email content reaching the agent. In the context of an AI email-handling plugin, broad sender access materially increases the attack surface because untrusted external users can directly influence agent behavior through inbound messages.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill clearly states elsewhere that AI agents can read and respond to emails, but it does not present a prominent user-facing warning about the sensitivity of granting an agent access to a mailbox and send capability. This can lead users to enable the integration without appreciating that the agent may process private messages or send outbound email on their behalf, increasing the risk of data exposure, unauthorized actions, and social-engineering amplification.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reports/plugin-inspector-issues.md (reported line 30)May include surrounding context.
md
## Triage Overview | Class | Count | P0 | Meaning | | ------------------- | ----- | -- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | live-issue | 0 | 0 | Potential runtime breakage in the target OpenClaw/plugin pair. P0 only when it is not a deprecated compat seam. | | compat-gap | 0 | - | Compatibility behavior is needed but missing from the target OpenClaw compat registry. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reports/plugin-inspector-report.md (reported line 36)May include surrounding context.
md
## Triage Overview | Class | Count | P0 | Meaning | | ------------------- | ----- | -- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | live-issue | 0 | 0 | Potential runtime breakage in the target OpenClaw/plugin pair. P0 only when it is not a deprecated compat seam. | | compat-gap | 0 | - | Compatibility behavior is needed but missing from the target OpenClaw compat registry. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reports/plugin-inspector-report.md (reported line 156)May include surrounding context.
md
## Decision Matrix | Fixture | Decision | Seam | Action | Evidence | | ------------------------- | ------------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------- | ------------ | | openclaw-apple-mail-skill | plugin-upstream-fix | package-metadata | Ask the plugin to declare the plugin API range it was built against. | package.json | | openclaw-apple-mail-skill | plugin-upstream-fix | package-entrypoint | Ask the plugin to declare openclaw.extensions or runtimeExtensions so cold import can target the correct entrypoint. | package.json |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest examples normalize unsafe default usage by showing allowFrom: ["*"] across multiple email accounts and pairing that with rapid polling and archiveOnReply, which could cause the agent to process messages from any sender and modify mailbox state without clear operator awareness. In an email-channel skill, this expands exposure to prompt-injection and privacy risks because untrusted inbound email can become agent input and replies may silently archive records.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 41)May include surrounding context.
json
"LICENSE" ], "peerDependencies": { "@jehadurre/openclaw-apple-mail": "^1.0.0" }, "scripts": {

Static analysis

No suspicious patterns detected.