AgentMail sending and receiving with Python scripts

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:30 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it helps an agent send email and download unread AgentMail messages, with disclosed local storage and mailbox state changes.

Install only if you are comfortable giving the skill an AgentMail API key that can send mail, read unread messages, save message contents locally, and mark those messages as read. Protect ~/.openclaw/workspace/agentmail/.env with restrictive permissions, treat MAIL.* files as sensitive email data, and consider pinning dependencies before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:44

Finding

AgentMail API key file is created without restrictive permissions

Content

View full analysis

~/.openclaw/workspace/agentmail/.env << 'EOF' AGENTMAIL_API_KEY=am_us_..... EOF ``` ### Technical Analysis The setup instructions write the AgentMail API key to a plaintext `.env` file without explicitly setting restrictive file permissions. The resulting permissions depend on the user's current `umask`. With a common `022` umask, the file can be created with mode `0644`, making it readable by other local users if they can traverse the parent directories. The API key is legitimately required for the declared email functionality, but making it potentially accessible outside the Agent account exceeds the minimum access necessary. This is a local credential-disclosure risk rather than evidence that the Skill intentionally transmits the key to an unrelated service. ### Attack Path 1. A user follows the documented setup instructions under a permissive `umask`. 2. The shell creates `.env` with group-readable or world-readable permissions. 3. Another local account traverses the workspace path and reads the `.env` file. 4. The attacker extracts `AGENTMAIL_API_KEY`. 5. The attacker authenticates to AgentMail using the stolen credential. 6. Subject to the API key's server-side permissions, the attacker reads mailbox data or sends messages as the configured inbox. ### Impact Assessment Successful exploitation discloses the AgentMail API credential. The attacker may gain the mailbox privileges granted to that key, potentially including access to email content and metadata, modification of message state, and the ability to send messages as the configured inbox. The scope is limited by local filesystem accessibility and the permissions assigned to the API key. This issue does not itself grant operating-system privilege escalation. ]]>

Remediation

View remediation

"$DEST/.env" << 'EOF' AGENTMAIL_API_KEY=am_us_..... EOF chmod 600 "$DEST/.env" ``` Additional hardening measures: - Prefer injecting the key through a dedicated secret manager or protected runtime environment rather than storing it in a project file. - Verify ownership before reading the file. - Exclude `.env` from source control and backups that are not approved for secrets. - Rotate the API key if the file was previously created with permissive permissions. - Restrict the API key server-side to only the mailbox operations required by this Skill. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Third-party Python dependencies are installed without version or integrity pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared behavior understates materially important side effects: downloaded emails are persisted locally and unread messages are marked read remotely. That mismatch can cause users or agents to invoke the skill expecting passive email access, while it actually changes mailbox state and stores potentially sensitive message contents on disk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill directs users to place an API key in a plaintext .env file under a workspace directory. Even though this is a common pattern, storing long-lived credentials in local plaintext can enable credential theft through other workspace access, backups, logs, or accidental check-in, leading to unauthorized mailbox access and email operations.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Create the .env file

bash

cat > ~/.openclaw/workspace/agentmail/.env << 'EOF'
AGENTMAIL_API_KEY=am_us_.....
EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · check_mail.py (reported line 75)May include surrounding context.

python

def main():
    load_dotenv(os.path.join(SCRIPT_DIR, ".env"))

    api_key = os.getenv("AGENTMAIL_API_KEY")
    if not api_key:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill performs filesystem writes and reads environment-backed credentials, but the manifest does not declare any tool scope or permission boundaries. That makes the capability less transparent to users and any execution framework, increasing the chance that sensitive actions occur without informed approval or sandboxing.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Deploy the skill

Copy the scripts and create the venv in the workspace:

bash

DEST=~/.openclaw/workspace/agentmail

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to download full message contents into local MAIL.* JSON files and mark messages as read, but it does not present a prominent warning about these privacy and state-change consequences before use. This can expose sensitive email bodies, metadata, and attachments to other local processes or users, and can interfere with auditability of unread mail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level docstring describes a download-only behavior. However, later code performs a mailbox update that changes labels from unread to read, which is a meaningful side effect contradicting the stated intent of mere batch download.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description frames the skill as sending email and downloading received email from an inbox. In addition to downloading and saving messages, this code updates each message's labels to remove "unread" and add "read", which is a state-changing mailbox operation not conveyed by the description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.