T09 · Insecure Skill Coding Practices
Warning
- Location
send_email.py:62- Finding
SMTP connections do not explicitly enforce certificate verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Send Email
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real SMTP email sender, but it can send arbitrary local files as attachments and includes an alternate mail script that conflicts with its stated credential boundary.
Review this skill carefully before installing. Use it only if you are comfortable giving the agent the ability to send email through your SMTP account, and require explicit user approval for every recipient and attachment path. Avoid attaching sensitive files unless you have verified the exact file and destination.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Note
- Location
send_email.sh:29- Finding
Legacy shell implementation violates the declared credential boundary
- Content
View full analysis
/dev/null 2>&1; then if [ "$ACCOUNT" != "default" ]; then mutt -s "$SUBJECT" -a "$ATTACHMENT" -- "$TO" < "$TMP_MAIL" -F ~/.msmtprc else mutt -s "$SUBJECT" -a "$ATTACHMENT" -- "$TO" < "$TMP_MAIL" fi else echo "警告: 附件功能需要安装 mutt，使用 msmtp 发送无附件版本" ``` ### Technical Analysis The controlling instructions state that the skill must not use `~/.msmtprc` and that SMTP settings are to be supplied through runtime-injected environment variables. The bundled shell implementation nevertheless passes `~/.msmtprc` to `mutt` whenever an attachment and a non-default account are supplied. Although the documented execution path uses `send_email.py`, the executable shell file remains part of the package and exposes an alternate configuration and credential path. This creates behavior that contradicts the declared security boundary and may cause an unintended local SMTP identity or account configuration to be used. ### Attack Path 1. A user, automation component, or agent directly invokes the bundled `send_email.sh` file instead of the documented Python entry point. 2. The caller supplies an attachment and a fifth argument other than `default`. 3. If `mutt` is installed, the script invokes it with `-F ~/.msmtprc`. 4. `mutt` loads the local configuration, which may contain account settings, credential commands, or other user-specific mail behavior. 5. The message may be processed through an unintended account or configuration path outside the runtime-injected environment declared by the skill. ### Impact Assessment The issue can cause unauthorized use of a locally configured mail account or exposure of message data to an unintended SMTP route. Its scope is limited to the permissions an ...[truncated 256 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
send_email.sh:17- Finding
Manual email-header construction permits header injection
- Content
View full analysis
"$TMP_MAIL" ``` ### Technical Analysis The script directly inserts the caller-controlled recipient and subject into RFC email headers without rejecting carriage-return or line-feed characters. Shell quoting protects these values from ordinary shell word splitting and command substitution at this point, but it does not prevent a value from containing additional email header lines. A malicious value can therefore modify the generated message metadata. For the direct `msmtp "$TO"` execution path, the explicit command-line recipient controls the envelope recipient, so injected `Bcc` or `Cc` headers are not by themselves proven to add envelope recipients. However, arbitrary headers such as `Reply-To`, additional `From` fields, or MIME-related headers can still alter message presentation and behavior. ### Attack Path 1. An attacker gains control of a recipient or subject argument passed to `send_email.sh`. 2. The attacker includes a newline followed by an additional RFC email header. For example, a subject can contain a line break followed by an attacker-controlled `Reply-To` header. 3. The `echo` command writes the injected line into the generated message without validation. 4. `msmtp` receives the modified RFC message and transmits the attacker-controlled headers. 5. The resulting email can direct replies to an attacker, misrepresent message metadata, or manipulate MIME interpretation. ### Impact Assessment Exploitation can compromise message integrity and facilitate phishing or reply redirection. It can also produce malformed messages or alter how downstream clients interpret the message. The vulnerable interpolation does not itself execute shell ...[truncated 196 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` Removing the legacy shell implementation in favor of the existing Python implementation is the safer long-term resolution. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
send_email.sh:16- Finding
Plaintext temporary email may remain after interruption
- Content
View full analysis
"$TMP_MAIL" ``` Cleanup is performed only on the normal execution path: ```bash EXIT_CODE=$? rm -f "$TMP_MAIL" ``` ### Technical Analysis `mktemp` safely generates a non-predictable temporary file and ordinarily creates it with restrictive permissions. However, the script does not install an `EXIT`, `INT`, `TERM`, or `HUP` trap immediately after creating the file. If the process crashes, is terminated, or exits unexpectedly between file creation and the explicit `rm`, the temporary file can remain on disk. It contains the recipient, subject, and complete plaintext email body. ### Attack Path 1. The script creates a temporary file and writes the message contents to it. 2. The process is interrupted, terminated, or crashes before reaching the explicit cleanup command. 3. The temporary file remains in the system temporary directory. 4. A privileged local user, forensic process, backup service, or other component with access to the file can recover the message contents. ### Impact Assessment The issue can disclose email recipients, subjects, and body contents stored in abandoned temporary files. Exposure is generally limited by the restrictive permissions normally applied by `mktemp`, but privileged users and processes may still access the data. This issue does not provide remote code execution, persistence, or privilege escalation. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly instructs the agent to send emails and attachments to external recipients, but it does not warn that this transmits potentially sensitive data outside the local environment. In an agent setting, this creates a realistic exfiltration path because a user or prompt could cause files or report contents to be emailed externally without clear consent or visibility.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Agent instructions
- Credentials: Never read config files. OpenClaw injects
skills.entries.send-email.envwhen the script runs — do not use the read tool on~/.openclaw/openclaw.jsonorworkspace/openclaw.json(exposes secrets). If the skill is enabled, assume env is configured; do not ask the user for passwords. Do not use ~/.msmtprc. - Send mail: Run the script under workspace (do not use the path under node_modules):
bash python3 ~/.openclaw/workspace/skills/send-email/send_email.py "recipient" "Subject" "Body"
- Credentials: Never read config files. OpenClaw injects
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file includes user-facing natural language in the module docstring and command-line usage/messages that assume Chinese-language use. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The function interface accepts an arbitrary attachment path and later reads it directly from the local filesystem without sandboxing or path restrictions. In a tool-using agent environment, this is dangerous because the email-sending feature can be repurposed to access and export unrelated local data not implied by the published skill purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill can read any local file path provided as an attachment and transmit its contents over email, which expands its effective capability beyond the stated manifest description of simply sending emails via SMTP. In an agent context, this creates a clear exfiltration path for local secrets, tokens, SSH keys, config files, or other sensitive data if a user or upstream prompt supplies a path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This skill can send emails and exfiltrate local file contents as attachments immediately based on provided arguments, with no confirmation prompt, allowlist, or disclosure barrier. In an agent context, that is dangerous because a prompt-injected or misdirected agent could send sensitive data or attachments to an attacker-controlled address without meaningful user awareness.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's descriptive comments and runtime messages are written in Chinese, which imposes a specific language/locale without offering a choice. Under the policy, hard-coded language requirements should be flagged unless the file explicitly documents a justified locale constraint or offers opt-in selection.
- Content
Static analysis
No suspicious patterns detected.