T09 · Insecure Skill Coding Practices
Error
- Location
store.js:15- Finding
Mailbox credentials and access tokens are stored in plaintext despite an encryption claim
- Content
View full analysis
- Remediation
View remediation
Security audit
Smart Email
Security checks for vulnerabilities and agentic risk
Overview
This email assistant is purpose-aligned, but it handles mailbox credentials and private email contents with materially under-disclosed and unsafe security controls.
Review before installing. This skill can read private email, store reusable mailbox and OAuth credentials, run a web admin UI, and send email contents to an external AI provider. Use only in a trusted local environment, prefer OAuth over app passwords, avoid custom IMAP servers until TLS validation is fixed, and do not rely on the current encrypted/local-only privacy claims.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
imap.js:61- Finding
TLS certificate validation is disabled for every custom IMAP server
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
ai.js:8- Finding
Email content and API credentials can be transmitted to an unrestricted AI endpoint
- Content
View full analysis
`[${i + 1}] 发件人: ${e.from || e.fromAddr || '未知'}\n主题: ${e.subject || '(无主题)'}\n正文摘要: ${(e.body || '').substring(0, 200)}` ).join('\n\n'); ``` ```js if (pathname === '/api/config' && req.method === 'POST') { const { key, value } = JSON.parse(body); if (!key) return json({ error: 'key required' }, 400); config.set(key, value); return json({ success: true }); } ``` ### Technical Analysis Individual summarization sends the sender, subject, and up to the fetched email body to an OpenAI-compatible endpoint. Batch summarization sends content excerpts from all fetched messages. The configured API key is attached as a bearer credential. The destination is entirely configuration-controlled. There is no HTTPS requirement, origin allowlist, confirmation of destination, content redaction, or warning whe ...[truncated 1325 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
server.js:44- Finding
Web mailbox API can be exposed over plaintext HTTP using a reusable URL bearer token
- Content
View full analysis
c.trim().split('=')) .find(([k]) => k === 'token')?.[1]; const queryToken = url.searchParams.get('token'); const expected = getOrCreateToken(); return cookieToken === expected || queryToken === expected; } ``` ```js if (pathname === '/api/login' && req.method === 'POST') { const { token } = JSON.parse(body); if (token === getOrCreateToken()) { res.writeHead(200, { 'Content-Type': 'application/json', 'Set-Cookie': `token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000`, }); res.end(JSON.stringify({ success: true })); } else { json({ error: 'Invalid token' }, 401); } return; } ``` ```js server.listen(PORT, () => { const token = getOrCreateToken(); console.log(`\n📧 Email Skill Web UI`); console.log(` http://localhost:${PORT}?token=${token}\n`); console.log(` Share this URL to give access (token included).\n`); }); ``` ```js function getToken() { const params = new URLSearchParams(location.search); return localStorage.getItem('email_token') || params.get('token') || ''; } ``` ```js if (urlToken) { try { await api('/api/login', { token: urlToken }); localStorage.setItem('email_token', urlToken); history.replaceState(null, '', location.pathname); } catch {} } ``` ### Technical Analysis The HTTP server calls `listen(PORT)` without explicitly binding to a loopback address. Depending on the runtime and network configuration, this can listen on all available interfaces. The interface is served over plaintext HTTP. The long-lived b ...[truncated 1586 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
cli.js:245- Finding
Mailbox passwords and API keys are accepted as command-line arguments
- Content
View full analysis
' })); return; } return await setupPassword(email, password, detected); ``` ```js const password = getFlag('password'); if (!password) { console.log(JSON.stringify({ action: 'setup_need_password', email, detected: detected.label, message: `Run again with: setup ${email} --password `, })); return; } await setupPassword(email, password, detected); ``` ```js function cmdConfig() { const key = args[1]; const value = args[2]; if (!key) { // Show all config const all = config.getAll(); ``` The documented interface requires commands such as: ```bash node /cli.js setup --password node /cli.js config ai_api_key ``` ### Technical Analysis Command-line arguments are not an appropriate transport for secrets. Depending on the operating system and execution environment, process arguments may be observable through process inspection tools while the command is running. They may also be retained in shell history, automation logs, chat transcripts, process accounting systems, telemetry, or Agent tool-call records. The Skill not only supports this pattern but instructs users and calling agents to use it for mailbox app passwords and AI API keys. ### Attack Path 1. A user or Agent runs the documented setup or configuration command with a secret in the argument list. 2. The complete command is retained in shell history, process telemetry, an orchestration log, or a chat/tool transcript; alternatively, another local user inspects the pro ...[truncated 529 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The public description frames the skill as a chat-based email assistant, but the documentation also exposes a standalone web UI, HTTP administration surface, persistent credential storage, and token-based access URL. This mismatch is security-relevant because reviewers and users may authorize the skill without realizing it opens an additional remotely reachable management interface and stores sensitive tokens.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill does not clearly warn users that email contents may be sent to an external AI service for summarization. Because email often contains highly sensitive personal or business information, omission of this disclosure undermines informed consent and can lead to unintended third-party data sharing.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The setup flow explicitly instructs users to provide email passwords or app passwords through chat. Collecting mailbox credentials in a chat-mediated workflow is highly dangerous because chat systems, bot logs, intermediaries, or compromised clients can capture reusable secrets that grant direct access to the user's email account.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation claims all data stays local and is not uploaded, yet AI summarization necessarily sends email content to an external AI API. This is a direct privacy and trust violation: users may expose confidential emails under the false belief that no third party receives them.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The function sends full email-derived content, including sender, subject, and body, to a third-party AI endpoint configured by
ai_api_base. In an email-assistant context this can expose sensitive personal, business, financial, or authentication-related content to an external processor without any visible consent, minimization, or trust restriction in this file, creating a significant privacy and data-governance risk.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The batch summarization path transmits snippets from multiple emails in one request to an external LLM API, amplifying the amount and variety of sensitive data disclosed in a single call. Because this skill is specifically designed to process inbox contents across providers and chat platforms, a compromise, misconfiguration, or untrusted API endpoint could expose a broad set of private communications at once.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The read command always summarizes the full message body, meaning simply reading an email causes its contents to be transmitted to the AI service automatically. In an email assistant context this is especially dangerous because it turns a basic viewing action into undisclosed third-party exfiltration of potentially highly sensitive correspondence.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Disabling TLS verification for custom IMAP connections without any user-facing disclosure removes an important security guarantee while giving users no indication their credentials and mailbox contents may be exposed to interception. Because this skill processes highly sensitive email data, the lack of warning increases the likelihood of unsafe use and silent compromise.
- Content
Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The lockfile pins ip-address 10.1.0, which the provided advisory data identifies as affected by parsing inconsistencies and an HTML-emitting XSS issue. In this email skill, the package is pulled in via socks and is likely not a primary UI surface, so exploitability depends on whether untrusted IP strings or rendered HTML output are exposed; however, keeping a known vulnerable transitive dependency is still a real supply-chain risk.
- Content
Known Vulnerable Dependency: nodemailer==8.0.2 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The lockfile includes nodemailer 8.0.2, and the referenced advisories indicate multiple known issues including header injection, denial of service in address parsing, and content resolution bypasses. This is especially concerning in an email assistant skill that processes and may generate email-related content across chat platforms, because untrusted message metadata, addresses, or attachments could flow into vulnerable mail-handling paths and enable spoofing, abuse of outbound mail generation, or service disruption.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code stores plaintext account passwords directly in SQLite and returns full account rows through retrieval helpers, making credential disclosure trivial if the database file or process memory is accessed. Because this skill handles email accounts, exposed passwords may enable direct login to mailboxes and potentially other services where users reuse credentials.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <body> <div class="container" id="app"> <!-- Login --> <div id="login-view" class="login-box" style="display:none"> <h2>📧 Email Assistant</h2> <p style="color:var(--text2);margin-bottom:20px">输入访问令牌登录</p>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The application accepts an access token through both a password field and, more critically, a URL query parameter via getToken()/init(). Tokens in URLs are commonly exposed through browser history, logs, screenshots, copied links, and Referer headers, making credential leakage much more likely in a chat-integrated email assistant.
- Content
html <div id="login-view" class="login-box" style="display:none"> <h2>📧 Email Assistant</h2> <p style="color:var(--text2);margin-bottom:20px">输入访问令牌登录</p> <input type="password" id="login-token" placeholder="Access Token" onkeydown="if(event.key==='Enter')doLogin()"> <button class="btn btn-primary" style="width:100%" onclick="doLogin()">登录</button> </div>
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries even though its documented behavior requires network access and likely reads configuration or environment-derived secrets. Missing scope declarations increase the chance that a host agent invokes the skill with broader privileges than users expect, weakening containment for a credential-handling email integration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill instructions and reply-format guidance are written to operate in Chinese, including trigger phrases, setup flow, and output recommendations, but do not offer users a language choice. This can violate language/locale policy expectations when the skill is presented to multilingual users or integrated into non-Chinese chat environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrases are broad enough to overlap with ordinary conversation, which can cause unintended invocation of a skill that accesses sensitive email data. In a chat environment, accidental activation can reveal inbox contents or start setup flows without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The prompt explicitly instructs the model to summarize emails in Chinese, and the batch prompt also requires Chinese output. This is a natural-language locale policy issue because the file imposes a specific language without any opt-in, configuration, or documented regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The batch prompt ends with an instruction to output in Chinese, with no indication that the user can choose another language. This creates a locale-policy concern because the skill hardcodes a language preference rather than offering a configurable or opt-in choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
When --summarize is used, full email body content is sent to the summarization backend without any visible consent, warning, or data-classification check. Because emails routinely contain sensitive personal, financial, or corporate information, silent transfer to an external AI provider creates a real confidentiality and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Digest generation sends batches of email data to the AI summarizer without an obvious warning that message contents may leave the local environment. Batch processing can amplify exposure by transmitting many emails at once, increasing both privacy impact and regulatory risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The setup flow accepts direct email passwords/app passwords and persists them for later mailbox access. For a chat-integrated assistant, storing reusable mailbox credentials expands the blast radius of any compromise and is riskier than delegated OAuth, especially when users may provide secrets through chat or automation layers not designed for credential handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The
removecommand deletes a configured account immediately after receiving the email argument, with no confirmation or cautionary message. Removing stored account configuration can be irreversible from the user's perspective and should have some disclosure or confirmation.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The config command can return arbitrary stored configuration values by key, and the single-key read path does not mask sensitive entries. In a chat-facing email assistant, this creates a direct secret-disclosure primitive for items like API keys, OAuth client settings, or other stored credentials if an untrusted user can invoke the CLI through the agent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The function accepts either an access token or password and uses it to connect to a mailbox, then fetches sender, recipient, subject, date, and body content from unread emails. This is sensitive account and message access, but this code includes no prompt, logging, or explanatory comment warning users that mailbox contents and credentials are being used.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
For custom IMAP hosts, the code sets
tls.rejectUnauthorizedtofalse, which disables certificate validation and permits man-in-the-middle interception of email credentials and message contents. In an email assistant handling sensitive inbox data, this materially weakens transport security and expands trust to arbitrary, potentially spoofed servers.- Content
Static analysis
No suspicious patterns detected.