Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local Thunderbird mail search tool, but users should treat its email and attachment access as sensitive.
Install only if you want an agent to inspect local Thunderbird mail. Use the narrowest profile, account, folder, and date filters possible; avoid printing full bodies or JSON in shared logs; save attachments only to an intended location; and do not open unknown attachments with the default app unless you accept the normal email-attachment malware risk.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# Thunderbird Skill for OpenClaw
Search and inspect local Mozilla Thunderbird mail storage directly from disk (mbox and Maildir), with filters for account, folder, sender, recipient, subject, body, unread state, time ranges, and attachments.
Referenced artifact was not completely inspected
If the current working directory is not the skill directory, resolve `scripts/search_thunderbird.py` relative to this `SKILL.md` location before running it.
Instructing the agent to open attachments with the system default app can cause untrusted email attachments to be executed or rendered by vulnerable local software. Since email attachments are a common malware delivery vector, auto-launch guidance is especially dangerous in a mail-inspection skill.
This markdown file documents the --save-attachments behavior and provides an example command that writes attachment files to a local output directory. The description does not include any warning that this operation creates files on disk and may handle sensitive email content, which is a user-impacting behavior covered by the markdown warning requirement.
The skill directs the agent to read local mail data, inspect environment-dependent profile locations, and save attachments to disk, but it declares no explicit tool scope or permission boundaries. That mismatch increases the chance an agent can access sensitive files or write extracted content without clear authorization controls.
The skill is designed to inspect local Thunderbird mail, which inherently contains sensitive personal and business communications, but the documentation lacks an explicit privacy warning or consent gate. Without that framing, an agent may over-collect or reveal email content and metadata more broadly than the user intended.
Reading and summarizing local email bodies and attachments creates a direct path to disclose highly sensitive communications, credentials, invoices, legal content, or personal data. In context, the capability is aligned with the skill's purpose, but it still needs privacy gating because the source material is unusually sensitive.
The default behavior instructs the agent to summarize mailbox path, date, sender, recipient, subject, and body preview, which can expose private email data even when only coarse search help is needed. Because these fields are sensitive and often enough to infer confidential matters, broad default disclosure is risky.
The attachment workflow permits extracting, reading, summarizing, saving, and opening files from email, which can disclose sensitive documents and increase the risk of interacting with malicious content. Attachments are both privacy-sensitive and a common malware vector, so combining data access with external opening makes this materially more dangerous.
The skill's stated purpose is reading and searching Thunderbird mail storage, but the attachment policy expands into opening extracted files with external applications. That broadens the attack surface from passive inspection to active execution of untrusted content, including attachment-triggered exploits in local applications.
The skill is described as reading and searching Thunderbird mail, but it also creates directories and writes attachment contents to arbitrary user-specified paths via --save-attachments. That expands the capability from read-only inspection to file export, increasing the risk of unintended data exfiltration or unauthorized persistence of sensitive email attachments on disk.
The code writes attachment files to disk silently once the flag is provided, without any additional disclosure in output or runtime confirmation that new files will be created. This can leave sensitive artifacts on disk in locations the user or calling agent may not anticipate, especially because filenames are preserved and collisions are resolved automatically.
Enabling attachment export in a skill whose stated purpose is only search/read access violates the principle of least privilege and broadens the operational scope beyond what users would reasonably expect. In a mail-analysis context, attachments often contain highly sensitive data, so export functionality materially increases privacy and exfiltration risk.
The script can output complete message bodies, senders, recipients, and subjects to stdout or JSON via --show-body and --json, which may expose sensitive local mail data. The file describes search functionality but does not include any warning that results may contain private user data in terminal output or downstream logs.
SQP-3 covers natural-language language or locale policy violations across all file types. The instruction to use the system default opener could implicitly enforce system-localized behavior, but the policy concern is weak because this is not an explicit language mandate.
No suspicious patterns detected.