T09 · Insecure Skill Coding Practices
Error
- Location
read_email.py:214- Finding
Mail-Controlled Attachment Filename Allows Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Full Mail
Security checks for vulnerabilities and agentic risk
Overview
This is a real email skill, but it includes unsafe mailbox deletion and attachment download behavior that can cause data loss or overwrite local files.
Install only if you are comfortable granting this skill access to send, read, search, mark read, and delete mail for the configured account. Avoid using attachment download on untrusted messages until filenames are sanitized and confined to the download directory, and be careful with delete because it expunges immediately. Use a provider app password, restrict the config file permissions, and revoke the credential if the file may have been exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
配置指南.md:9- Finding
Mailbox Application Credential Is Stored in Plaintext Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A mismatch between declared purpose and actual mail-management behaviors is security-relevant because users may authorize a 'mail send/receive' skill without realizing it can also delete messages, mark mail read, search, or download attachments. Hidden or under-described capabilities reduce informed consent and can enable destructive or privacy-impacting actions under misleading documentation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A mismatch between declared purpose and actual mail-management behaviors is security-relevant because users may authorize a 'mail send/receive' skill without realizing it can also delete messages, mark mail read, search, or download attachments. Hidden or under-described capabilities reduce informed consent and can enable destructive or privacy-impacting actions under misleading documentation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The delete command immediately marks a message as deleted and expunges it without any confirmation, preview, or safety interlock. This makes accidental or scripted invocation capable of causing irreversible mailbox data loss, which is especially risky in an agent skill that may be triggered non-interactively.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents capabilities that require network access and use of sensitive environment variables, but it does not declare an explicit tool scope or permissions boundary. In an agent ecosystem, this weakens reviewability and may allow a mail-capable skill to operate with broader access than users or orchestrators expect, increasing the chance of unauthorized outbound communication or credential use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation instructs users how to send mail, download attachments, mark messages read, and delete emails, but it does not warn about the privacy, integrity, and destructive consequences of those actions. In a mail skill, omission of these warnings makes accidental data disclosure, malware retrieval via attachments, or irreversible mailbox changes more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script's usage text, help output, and runtime messages are all hardcoded in Chinese, which forces a specific language experience on users. There is no option to select another language or indication that the tool is intentionally limited to a Chinese-speaking context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The attachment download feature writes attacker-controlled filenames from email content directly to disk without prior warning or sanitization. Besides unexpected filesystem modification, this can enable path traversal if a crafted attachment name contains directory components, potentially overwriting files outside the intended download folder.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains user-facing natural-language text exclusively in Chinese in the module docstring and command usage. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guide explicitly documents attachment download and email deletion operations, which can affect sensitive data and permanently modify a user's mailbox, but it does not provide clear warnings, confirmation guidance, or safety notes specific to those actions. In a mail-management skill, these operations are legitimate, yet omitting cautions increases the risk of accidental privacy exposure or destructive misuse by users or downstream agents.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language content of the skill forces a specific language/locale for users by presenting the description and operational guidance exclusively in Chinese. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, which is not present here.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes a full mail skill for SMTP/IMAP send and receive. While IMAP access itself is expected, directly harvesting credentials from process environment variables is a separate sensitive-capability choice that is not described in the skill purpose and is not inherent to mail handling logic.
- Content