ClawHub
Back to skill

Security audit

Clawaimail

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can send, read, create, and permanently delete email through a third-party service with weak install pinning and limited safety disclosure.

Install only if you are comfortable giving this MCP server an API key that can access and mutate ClawAIMail email data. Prefer a dedicated, revocable, least-privilege key; pin the npm package to a reviewed exact version; avoid sensitive mailboxes; and require human confirmation before sending email or deleting inboxes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:50
Finding

Unpinned npm Package Execution Through npx

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

Claude Code / Cursor

Add to your MCP config (~/.claude/mcp.json or Cursor settings):

json
{

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

delete_inbox immediately performs a destructive DELETE of an inbox and all its messages, with no confirmation flow, soft delete, or guardrail. In autonomous or loosely supervised agent workflows, prompt mistakes, tool misuse, or adversarial instruction injection could cause irreversible data loss across the mailbox.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High
Category
Supply Chain
Confidence
91% confidence
Finding

fast-uri 3.1.0 is listed with multiple host confusion and SSRF-related advisories, which are serious when software parses or validates attacker-influenced URLs. In an email-management skill, URL processing can plausibly occur in message content, webhooks, OAuth flows, or remote resource handling, so a vulnerable URI parser raises meaningful risk beyond a theoretical package-only concern.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.5 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
93% confidence
Finding

hono 4.12.5 is associated with numerous advisories affecting cookie handling, routing, and request/path validation. Because the skill provides email API integration and likely exposes an MCP or HTTP-facing service, flaws in routing, cookies, or request processing can materially affect confidentiality or access control if the server layer is reachable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High
Category
Supply Chain
Confidence
84% confidence
Finding

ip-address 10.1.0 has advisories for leading-zero parsing ambiguity and XSS in HTML-emitting helpers. The SSRF/filter-bypass angle is relevant if this skill or its dependencies validate client IPs, proxy headers, or allow/deny network destinations; the XSS angle is less likely unless rendered HTML helpers are used, but the package version is still genuinely vulnerable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High
Category
Supply Chain
Confidence
90% confidence
Finding

path-to-regexp 8.3.0 is flagged for ReDoS/DoS issues involving crafted route patterns and matching behavior. If the MCP/HTTP server stack processes attacker-controlled paths, these bugs can degrade availability through expensive matching, which matters for an always-on email automation service even if it does not directly expose arbitrary regex input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README advertises capabilities to read, send, search, and delete email without any warning about privacy sensitivity, destructive actions, or the need for user confirmation. In an agent-integrated context, those omissions increase the risk that users enable a tool with broad mailbox access without understanding that it can expose private correspondence or perform irreversible actions like inbox deletion.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documents capabilities that require network access and use of an environment-stored API key, but it does not declare any explicit permission scope such as allowed tools or permissions. That makes the trust boundary opaque: a user may install the skill without realizing it can transmit email content and metadata to an external service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The skill is explicitly designed to persist and manage email sessions, inboxes, threads, and message history over time. Persistent communication data increases exposure if the agent is misused, over-privileged, or accessed by an unintended party, because sensitive historical emails and account state remain available across sessions.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
# ClawAIMail - Email for AI Agents

Give your AI agent its own email address. Create inboxes, send and receive real emails, search messages, and manage threads — all through a simple API.

## What it does

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages sending, receiving, reading, and searching emails through a third-party API but does not explicitly warn that message bodies, headers, recipients, and related metadata may be disclosed to an external provider. Users may unknowingly route sensitive communications through the service, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The setup instructions invoke an MCP server via npx -y clawaimail-mcp without pinning a specific package version or integrity source. This creates a supply-chain risk: future package updates or a compromised npm release could change the code executed on user machines without notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented delete_inbox capability permanently removes an inbox and all associated messages, but the skill does not warn users about irreversible data loss or recommend confirmation safeguards. In an agent context, a mistaken or prompt-induced deletion could destroy records or communications that cannot be recovered.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Several read-oriented tools such as send-by-default, list_messages, read_email, search_emails, and my_email call getDefaultInbox(), which will create a remote inbox if none exists. That means a user or upstream agent invoking what appears to be a non-mutating or low-risk action can trigger account-side resource creation and state changes without explicit consent, violating least surprise and enabling unintended provisioning/sprawl.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code automatically issues a POST to /v1/inboxes when no inbox exists, without an explicit user confirmation step and only logs the action to stderr. In an agent setting, this can convert an innocuous request into an external write operation, causing unauthorized resource creation, billing/limit consumption, and side effects a caller did not intend.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest frames the skill as providing an email address and email send/receive/manage operations, but the account_info tool retrieves broader account metadata from /v1/me, including plan limits and usage. That is adjacent to administration/billing visibility rather than core email handling, so the implementation exceeds the plainly stated purpose.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low
Category
Supply Chain
Confidence
87% confidence
Finding

The lockfile pins @hono/node-server 1.19.11, and the reported advisories describe middleware bypass and Windows path traversal issues in static file serving behavior. Although a lockfile alone does not prove the vulnerable code path is exercised, bundling a known-vulnerable version is a real supply-chain risk because this skill exposes email-related functionality and may run an HTTP/MCP server surface where request routing or static-serving bugs could be reachable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low
Category
Supply Chain
Confidence
82% confidence
Finding

body-parser 2.2.2 is flagged for a denial-of-service condition tied to invalid limit handling. This is a genuine dependency risk, though its practical exploitability depends on whether this skill accepts attacker-controlled HTTP request bodies through Express or related server functionality pulled in by the MCP SDK.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low
Category
Supply Chain
Confidence
80% confidence
Finding

qs 6.15.0 has published denial-of-service and parsing-bypass advisories. This is a real dependency issue, but the impact is lower unless the skill exposes querystring or form parsing on attacker-controlled HTTP traffic through Express-compatible middleware.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json
"url": "https://github.com/joansongjr/clawaimail"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "zod": "^3.22.0"
  },
  "files": [

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json
},
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "zod": "^3.22.0"
  },
  "files": [
    "index.js"

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:7