ClawHub
Back to skill

Security audit

Mailbox

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real email-management skill, but it asks users or agents to run a remote installer, keep mailbox credentials on disk, and optionally install a persistent mail daemon.

Review before installing. Prefer a pinned or verifiable install path instead of piping a remote script to a shell, configure only the mail accounts you want the agent to access, lock down the auth file permissions, and skip the daemon unless you specifically need always-on mailbox automation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill instructs the agent to install and immediately execute remote code via a `curl ... | sh` pipeline from GitHub before performing its stated email functions. This is dangerous because it bypasses package integrity verification, grants arbitrary code execution in the agent environment, and expands a mailbox-reading skill into a software supply-chain execution path.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill bundles software installation and PATH modification behavior into documentation for an email-management capability, creating privilege and execution scope beyond what is necessary to read or send email. That makes the skill more dangerous because invoking it can lead to system changes and execution of external code rather than only mailbox operations.

Session Persistence

Medium
Category
Rogue Agent
Content
#    (npm is deprecated: `npm install -g @leeguoo/mailbox-cli` may lag the releases)

# 2. Configure accounts (edit credentials):
mkdir -p ~/.config/mailbox
cp $(npm prefix -g)/lib/node_modules/@leeguoo/mailbox-cli/examples/accounts.example.json \
   ~/.config/mailbox/auth.json
$EDITOR ~/.config/mailbox/auth.json
Confidence
86% confidence
Finding
mkdir -p ~/.config/mailbox cp $(npm prefix -g)/lib/node_modules/@leeguoo/mailbox-cli/examples/accounts.example.json \ ~/.config/mailbox/auth.json $EDITOR ~/.config

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.