ClawHub
Back to skill

Security audit

Mailbox

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent email-management helper, but it asks agents/users to run an unverified remote installer and recommends persistent mailbox access for a very sensitive account category.

Review carefully before installing. Prefer a pinned release with checksum or signature verification instead of curl | sh, protect ~/.config/mailbox/auth.json with restrictive permissions and app-specific credentials, and avoid installing the login daemon unless you explicitly want background mailbox sync and understand where cached email data is stored.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:34
Finding

Unpinned Remote Installation Script Executed Directly by a Shell

Content
View full analysis
Remediation
View remediation
.tar.gz ``` 4. Publish a trusted SHA-256 digest through a separately protected release process and verify it before extraction: ```bash echo " mailbox.tar.gz" | sha256sum --check - ``` 5. Prefer cryptographic release signatures with a documented, pinned public key. A checksum hosted only beside a compromised artifact does not independently establish trust. 6. Extract and install only the expected binary into a user-owned directory without invoking an arbitrary installer script. 7. Document the exact files created and required permissions. 8. Do not install automatically merely because `mailbox` is absent. Ask for explicit user approval and show the source, version, destination, and verification result. 9. If an installation script is unavoidable, pin it to an immutable commit, download it for inspection, verify its digest or signature, and execute it only after explicit approval. ]]>

T06 · System Persistence

Warning
Location
SKILL.md:70
Finding

Optional Email Daemon Establishes Cross-Session User-Level Persistence

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (7)

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The shell pipeline into sh is a classic command-chaining abuse pattern because it turns downloaded content into immediate shell input with no inspection or integrity validation. In the context of a skill file, this is more dangerous because an agent may treat the instruction as an endorsed operational step and execute it non-interactively.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

non-interactively from GitHub Releases (no npm, no auth) before doing anything else:

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/Mailbox/main/install.sh | sh
# installs the prebuilt binary to ~/.local/bin — make sure that's on PATH, then re-probe
export PATH="$HOME/.local/bin:$PATH"; mailbox --version

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

This second instance repeats the same unsafe chaining pattern and normalizes direct execution of network-fetched code. Because the skill is intended for agent use, such instructions materially increase the risk of automated remote code execution if the source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash
# 1. Install the CLI from GitHub Releases (no npm/Node needed; prebuilt binary):
curl -fsSL https://raw.githubusercontent.com/leeguooooo/Mailbox/main/install.sh | sh
#    (npm is deprecated: `npm install -g @leeguoo/mailbox-cli` may lag the releases)

# 2. Configure accounts (edit credentials):

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says to use the skill for specific phrases and then expands scope to "or anything that involves listing / searching / reading / writing / classifying messages from one or more mailboxes." That catch-all activation language is very broad and lacks exclusion conditions, increasing the chance of unintended invocation for ordinary conversation about email.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The setup instructions tell the user to place live mailbox credentials into ~/.config/mailbox/auth.json without warning about the sensitivity of that file, filesystem permissions, backup exposure, or local compromise risk. Because this skill manages multiple email accounts, compromise of that file could expose mailbox contents and enable sending, deletion, and account takeover workflows via email.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

This skill directs users to persist email credentials in a local configuration file under ~/.config/mailbox/auth.json, creating durable credential storage on disk. Persistent storage increases the attack surface through local malware, shared accounts, insecure backups, or accidental disclosure, especially given the high-value nature of email accounts.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
#    (npm is deprecated: `npm install -g @leeguoo/mailbox-cli` may lag the releases)

# 2. Configure accounts (edit credentials):
mkdir -p ~/.config/mailbox
cp $(npm prefix -g)/lib/node_modules/@leeguoo/mailbox-cli/examples/accounts.example.json \
   ~/.config/mailbox/auth.json
$EDITOR ~/.config/mailbox/auth.json

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs the agent/user to fetch and execute a remote install script directly from GitHub using curl piped to sh, which grants immediate code execution to whatever content is served at that URL at execution time. If the repository, branch, network path, or hosting account is compromised, this becomes a straightforward remote code execution vector on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

non-interactively from GitHub Releases (no npm, no auth) before doing anything else:

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/Mailbox/main/install.sh | sh
# installs the prebuilt binary to ~/.local/bin — make sure that's on PATH, then re-probe
export PATH="$HOME/.local/bin:$PATH"; mailbox --version

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

This repeated installation instruction again fetches and executes a remote script from a mutable URL. Repetition increases the chance that an agent will follow the unsafe pattern automatically, making compromise of the upstream source or script distribution path especially dangerous.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash
# 1. Install the CLI from GitHub Releases (no npm/Node needed; prebuilt binary):
curl -fsSL https://raw.githubusercontent.com/leeguooooo/Mailbox/main/install.sh | sh
#    (npm is deprecated: `npm install -g @leeguoo/mailbox-cli` may lag the releases)

# 2. Configure accounts (edit credentials):

Static analysis

No suspicious patterns detected.