Aliyun Mail

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:36 PM UTC
• Version: 1.0.0

Overview

This email skill does what it claims, but it handles SMTP credentials and local file attachments with weak safeguards, including possible unencrypted login.

Review this before installing. Use a dedicated app password, keep the config file private, require TLS or STARTTLS in configuration, and carefully verify every recipient, body file, and attachment path before sending sensitive content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: email_sender.py:178

Finding

SMTP Credentials May Be Transmitted Without Encryption

Content

View full analysis

Vulnerability Details

File Location: email_sender.py, lines 178–185
Vulnerability Type: Plaintext transmission of SMTP credentials and email content
Risk Level: High

Vulnerable Code:

python

if config.get('useTLS', False):
    server = smtplib.SMTP_SSL(config['server'], config['port'])
else:
    server = smtplib.SMTP(config['server'], config['port'])
    if config.get('startTLS', False):
        server.starttls()

server.login(config['username'], config['password'])

Technical Analysis

Both useTLS and startTLS default to False. If either setting is omitted from the configuration, or both are explicitly disabled, the application creates a plaintext SMTP connection and subsequently invokes server.login().

SMTP authentication mechanisms commonly encode credentials rather than encrypting them. Without transport-layer encryption, a network-positioned attacker can observe the authentication exchange, SMTP envelope, message headers, email body, and attachments. The application does not reject insecure configurations or require encryption before authentication.

The SMTP hostname and port are also configuration-controlled. Anyone able to provide or modify the configuration can direct the application to an attacker-operated SMTP endpoint. This does not expose unrelated system privileges, but it can disclose the configured mailbox credentials and all email data sent during the affected execution.

Attack Path

1. The attacker modifies the SMTP configuration, supplies a configuration through --config, or causes TLS-related properties to be omitted.
2. The resulting configuration has both useTLS and startTLS absent or set to false.
3. The application opens a plaintext connection with smtplib.SMTP(config['server'], config['port']).
4. The application calls server.login(config['username'], config['password']) without first establishing TLS.
5. An attacker controlling the S ...[truncated 865 chars]

Remediation

View remediation

Remediation Suggestions

• Require encrypted SMTP transport before authentication. Reject configurations where neither implicit TLS nor STARTTLS is enabled.

• Use TLS as the secure default instead of defaulting both controls to False.

• Create and pass a certificate-validating SSL context:

  python

  import ssl
  
  context = ssl.create_default_context()
  
  if config.get("useTLS", True):
      server = smtplib.SMTP_SSL(
          config["server"],
          config["port"],
          context=context
      )
  elif config.get("startTLS", False):
      server = smtplib.SMTP(config["server"], config["port"])
      server.ehlo()
      server.starttls(context=context)
      server.ehlo()
  else:
      raise ValueError("Refusing to authenticate over plaintext SMTP")
  
  server.login(config["username"], config["password"])
  

• Do not disable certificate or hostname validation.

• Validate configuration before connecting, including the server hostname, port, and TLS mode.

• If plaintext SMTP is essential for isolated development environments, place it behind an explicit option such as allowInsecureSMTP, default it to false, and display a prominent warning.

• Prefer app-specific credentials with the minimum permissions necessary and rotate any credentials that may have traversed an unencrypted connection.

• Add automated tests confirming that authentication cannot occur unless a validated TLS session has been established.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents a skill that transmits message content and file attachments over SMTP to external recipients, but the usage section does not warn users that email bodies, recipient addresses, and attached files may contain sensitive data and will be sent off-system. For markdown files, missing user-facing warnings about behaviors affecting privacy or data exposure should be flagged.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents file-based capabilities such as reading a body from a file and attaching arbitrary files, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, undeclared file access increases the chance that the skill can be invoked with broader-than-expected filesystem reads, which can expose sensitive local data through email exfiltration.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

Ensure the configuration file has secure permissions:

bash

chmod 600 /root/.openclaw/aliyun-mail-config.json

Usage

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Ensure the configuration file has secure permissions:

bash

chmod 600 /root/.openclaw/aliyun-mail-config.json

Usage

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill enables sending arbitrary body content and attachments to an external SMTP service, but it does not clearly warn users that local file contents and message text will leave the environment. In a prompt-driven agent workflow, this omission raises the risk of accidental exfiltration of sensitive data, especially when body-file and attachments are sourced from local paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code file performs a network operation that transmits user-provided content and optional attachments via SMTP. While the module docstring says it sends emails, the send path itself lacks any confirmation prompt or user-facing disclosure before transmitting the data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The README content is presented in Chinese throughout, which can functionally impose a language requirement on users without any opt-in or explanation. The policy requires flagging language or locale constraints unless the skill offers a choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill reads a local SMTP configuration file and later uses the contained username and password for authentication. Although this is functionally necessary, there is no explicit disclosure in the code comments or interface that the skill accesses stored credentials from disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.