Security audit

eMail manager lite

Security checks for vulnerabilities and agentic risk

Overview

This email skill is mostly transparent about reading, sending, and moving mail, but it disables IMAP certificate verification while handling email credentials and private mailbox data.

Install only if you are comfortable giving this tool access to an email account that can read mail, send mail, and move messages. Prefer a narrowly scoped app password or test mailbox, fix IMAP TLS verification before use, and avoid trusting terminal output from untrusted email content until sanitization is added.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/email.js:30
Finding: IMAP TLS Certificate Verification Is Disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/email.js:173
Finding: Untrusted Email Content Is Printed Without Terminal Control-Sequence Sanitization
Content: View full analysis
{ const size = formatBytes(att.size || 0); const type = att.contentType || 'unknown'; return ` [${idx + 1}] ${att.filename || 'unnamed'} (${type}, ${size})`; }).join('\n'); ``` Parsed email headers and body content are also emitted directly: ```javascript console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`); console.log(`📧 UID: ${uid}`); console.log(`From: ${mail.from.text}`); console.log(`To: ${mail.to ? mail.to.text : EMAIL_USER}`); console.log(`Subject: ${mail.subject}`); console.log(`Date: ${mail.date}`); console.log(`Attachments: ${mail.attachments.length > 0 ? mail.attachments.length : 'None'}`); if (mail.attachments.length > 0) { console.log(`\n📎 Attachment Details:`); console.log(formatAttachments(mail.attachments)); } console.log(`\n📝 Body:\n${mail.text.substring(0, 500)}${mail.text.length > 500 ? '...' : ''}`); console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`); ``` Folder names received from the IMAP server are similarly printed without sanitization: ```javascript function printBox(box, name, indent = '') { const flags = box.attribs || []; const delimiter = box.delimiter || '/'; const hasChildren = box.children && Object.keys(box.children).length > 0; console.log(`${indent}📁 ${name}${hasChildren ? delimiter : ''} ${flags.join(', ')}`); if (box.children) { Object.keys(box.children).forEach(childName => { printBox(box.children[childName], childName, indent + ' '); }); } } ``` ### Technical Analysis Email senders control substantial portions of the data displayed by the program, including sender names, subjects, body text, and attachment filenames. The script sends these values directly to `console.l ...[truncated 2151 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package.json:12
Finding: Dependencies Are Not Reproducibly Pinned
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (41)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description presents a lightweight cross-provider email manager, but the documented behavior includes mailbox reading, message movement, and outbound sending using credentials from the environment without declared permissions. This mismatch can cause users to authorize or install the skill without appreciating that it can access private communications, modify mailbox state, and transmit email to external services.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.
md
- Edit `scripts/email.js` and change:

Static analysis

No suspicious patterns detected.