Lumbox

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 1.0.2

Overview

This skill is purpose-built for agent email, OTP, signup, browser, and credential workflows, but it asks agents to run unpinned external npm packages and self-provision/store credentials with limited user-control guidance.

Review before installing. Only use this with accounts and services where you are comfortable letting a third-party email provider and MCP tooling handle messages, OTPs, verification links, and stored credentials. Prefer pinned package versions, scoped inbox keys, sandboxed execution, and clear user confirmation before signup, OTP retrieval, sending mail, or credential-vault use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Packages Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16 and SKILL.md:69
Vulnerability Type: Unpinned executable dependencies
Risk Level: Medium

Vulnerable Code

bash

npx lumbox signup --source openclaw

bash

openclaw mcp add lumbox -- npx @lumbox/mcp-server

Technical Analysis

The documented setup commands use npx to execute the lumbox and @lumbox/mcp-server packages without exact version constraints, integrity hashes, or a lockfile. As a result, execution can resolve to mutable package versions available from the configured npm registry at invocation time rather than to artifacts reviewed with this Skill.

This creates a supply-chain risk: compromise of a package publisher, registry account, package release, or dependency can alter the code subsequently executed by users. The MCP server is especially sensitive because the Skill describes it as providing browser automation, credential-vault, TOTP, email, and related capabilities.

No evidence establishes that the current packages are malicious. The finding concerns the unsafe, unpinned retrieval and execution model.

Attack Path

1. An attacker compromises the publishing process or account for lumbox, @lumbox/mcp-server, or a runtime dependency.
2. The attacker publishes a malicious release that becomes the version resolved by an unpinned npx invocation.
3. A user or Agent follows the instructions in SKILL.md.
4. npx retrieves and executes the altered package.
5. The package runs with the invoking user's process privileges and may attempt to access local files, environment variables, Lumbox credentials, or data exposed through the configured Agent workflow.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npx. Depending on the execution environment and available credentials, the compromised package could access the API key stored in ~/.lumbox/config.json or LUMBOX_API_KEY, ...[truncated 321 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both packages to exact, reviewed versions, for example:

   bash

   npx --yes lumbox@X.Y.Z signup --source openclaw
   openclaw mcp add lumbox -- npx --yes @lumbox/mcp-server@X.Y.Z
   

2. Publish expected package versions and integrity digests in the Skill documentation.
3. Prefer installation through a committed lockfile using a deterministic installer such as npm ci.
4. Review packages and their transitive dependencies before updating pinned versions.
5. Run the CLI and MCP server in a sandbox or container with restricted filesystem and network access.
6. Use inbox-scoped API keys where possible rather than an organization-wide key.
7. Avoid exposing unrelated secrets through environment variables, mounted home directories, or shared Agent contexts.
8. Establish a controlled update process that verifies provenance, package signatures where available, integrity metadata, and release changes before changing the pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description encourages use whenever an agent needs email, OTP handling, signups, correspondence, browser automation, and credential management, without clear trigger constraints or user approval boundaries. This broad invocation language increases the chance that the skill is auto-selected for sensitive workflows involving account creation, authentication interception, and credential storage without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs agents to execute npx lumbox without pinning a specific package version, which creates a supply-chain risk: a future malicious or compromised release could be fetched and executed automatically. This is especially dangerous here because the command is used for self-signup and key provisioning, so executed code could steal generated API keys or alter account setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup section tells the agent to self-sign up, create an org, and save an API key to ~/.lumbox/config.json, but it does not prominently warn that this provisions third-party accounts and stores credentials on disk. In this context, the omission is dangerous because the skill is designed for autonomous account creation and later credential use, which has privacy, billing, and persistence implications.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This unpinned npx lumbox invocation lets the latest package version run at execution time, exposing users to malicious updates or package compromise. In the context of creating inboxes used for account registration, a compromised package could intercept identifiers, route mail to an attacker, or exfiltrate credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The OTP and email-processing sections describe sending inbox contents, parsed OTP codes, links, and metadata through an external service but omit a clear privacy and security warning. Because these messages may contain authentication tokens, verification links, and sensitive correspondence, users may unknowingly expose account-recovery or login material to a third party.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using unpinned npx lumbox for OTP retrieval is risky because the command processes highly sensitive authentication material. If the package is compromised, it could capture one-time passwords and verification links and forward them to an attacker in real time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

An unpinned npx lumbox send command still creates supply-chain exposure because arbitrary code from the latest package release may execute when sending mail. While less directly sensitive than OTP retrieval, it can still leak message contents, API keys, and metadata or send unauthorized messages.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The unpinned npx lumbox inbox list invocation can execute whatever package version is current at the time, enabling supply-chain compromise. Even read-oriented commands may expose inbox identifiers, addresses, and local configuration secrets to malicious code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The MCP server is launched via unpinned npx @lumbox/mcp-server, which is particularly dangerous because MCP servers often receive broad tool permissions and access to credentials, browser automation, and external communications. A malicious or compromised package release could gain extensive control over agent actions and exfiltrate vault contents, OTPs, emails, and session data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This API reference promotes receiving emails, extracting OTP codes, and handling verification links, but gives no warning that these flows process authentication secrets and potentially sensitive correspondence. In this skill’s context, that omission is more dangerous because the product is explicitly designed for autonomous agents to sign up for services and manage inboxes with zero human oversight, increasing the chance of over-collection, insecure storage, or misuse of credentials and one-time codes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The documentation instructs users to run npx @lumbox/mcp-server without pinning a specific version or integrity source, which can cause agents to fetch and execute whatever package version is current at runtime. In an agent context that also exposes email, OTPs, browser automation, and credential-vault capabilities, a compromised or malicious upstream package release could immediately gain access to highly sensitive workflows and secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.