Security audit

Thunderbird

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local Thunderbird mail search tool, but users should treat its email and attachment access as sensitive.

Install only if you want an agent to inspect local Thunderbird mail. Use the narrowest profile, account, folder, and date filters possible; avoid printing full bodies or JSON in shared logs; save attachments only to an intended location; and do not open unknown attachments with the default app unless you accept the normal email-attachment malware risk.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Hidden Instructions

High

Category: Prompt Injection
Content: # Thunderbird Skill for OpenClaw Search and inspect local Mozilla Thunderbird mail storage directly from disk (mbox and Maildir), with filters for account, folder, sender, recipient, subject, body, unread state, time ranges, and attachments.
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Ae1

High

Category: analysis-evasion
Content: If the current working directory is not the skill directory, resolve `scripts/search_thunderbird.py` relative to this `SKILL.md` location before running it.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Instructing the agent to open attachments with the system default app can cause untrusted email attachments to be executed or rendered by vulnerable local software. Since email attachments are a common malware delivery vector, auto-launch guidance is especially dangerous in a mail-inspection skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This markdown file documents the `--save-attachments` behavior and provides an example command that writes attachment files to a local output directory. The description does not include any warning that this operation creates files on disk and may handle sensitive email content, which is a user-impacting behavior covered by the markdown warning requirement.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill directs the agent to read local mail data, inspect environment-dependent profile locations, and save attachments to disk, but it declares no explicit tool scope or permission boundaries. That mismatch increases the chance an agent can access sensitive files or write extracted content without clear authorization controls.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill is designed to inspect local Thunderbird mail, which inherently contains sensitive personal and business communications, but the documentation lacks an explicit privacy warning or consent gate. Without that framing, an agent may over-collect or reveal email content and metadata more broadly than the user intended.

Ssd 3

Medium

Confidence: 88% confidence
Finding: Reading and summarizing local email bodies and attachments creates a direct path to disclose highly sensitive communications, credentials, invoices, legal content, or personal data. In context, the capability is aligned with the skill's purpose, but it still needs privacy gating because the source material is unusually sensitive.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The default behavior instructs the agent to summarize mailbox path, date, sender, recipient, subject, and body preview, which can expose private email data even when only coarse search help is needed. Because these fields are sensitive and often enough to infer confidential matters, broad default disclosure is risky.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The attachment workflow permits extracting, reading, summarizing, saving, and opening files from email, which can disclose sensitive documents and increase the risk of interacting with malicious content. Attachments are both privacy-sensitive and a common malware vector, so combining data access with external opening makes this materially more dangerous.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill's stated purpose is reading and searching Thunderbird mail storage, but the attachment policy expands into opening extracted files with external applications. That broadens the attack surface from passive inspection to active execution of untrusted content, including attachment-triggered exploits in local applications.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill is described as reading and searching Thunderbird mail, but it also creates directories and writes attachment contents to arbitrary user-specified paths via --save-attachments. That expands the capability from read-only inspection to file export, increasing the risk of unintended data exfiltration or unauthorized persistence of sensitive email attachments on disk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code writes attachment files to disk silently once the flag is provided, without any additional disclosure in output or runtime confirmation that new files will be created. This can leave sensitive artifacts on disk in locations the user or calling agent may not anticipate, especially because filenames are preserved and collisions are resolved automatically.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Enabling attachment export in a skill whose stated purpose is only search/read access violates the principle of least privilege and broadens the operational scope beyond what users would reasonably expect. In a mail-analysis context, attachments often contain highly sensitive data, so export functionality materially increases privacy and exfiltration risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script can output complete message bodies, senders, recipients, and subjects to stdout or JSON via --show-body and --json, which may expose sensitive local mail data. The file describes search functionality but does not include any warning that results may contain private user data in terminal output or downstream logs.

Natural-Language Policy Violations

Low

Confidence: 46% confidence
Finding: SQP-3 covers natural-language language or locale policy violations across all file types. The instruction to use the system default opener could implicitly enforce system-localized behavior, but the policy concern is weak because this is not an explicit language mandate.

Static analysis

No suspicious patterns detected.