ClawHub
Back to skill

Security audit

mail-skill

Security checks across malware telemetry and agentic risk

Overview

This email skill does what it says, but it needs review because it can change mailbox state, store full mail locally, expose verification codes, and save attachments unsafely.

Install only if you are comfortable giving the agent mailbox access. Use an app-specific mail password, protect or encrypt the mail_data directory, avoid broad fetches, require manual approval before send/delete/move/export actions, and patch attachment filename handling and verification-code redaction before fetching untrusted mail.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (16)

Tainted flow: 'att_path' from os.getenv (line 142, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
for att in email_data['attachments']:
                    if att.filename:
                        att_path = os.path.join(att_dir, att.filename)
                        with open(att_path, 'wb') as f:
                            f.write(att.payload)
                        db_attachments.append({
                            'filename': att.filename,
Confidence
99% confidence
Finding
with open(att_path, 'wb') as f:

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly exercises sensitive capabilities—environment access for credentials, local file read/write for stored mail and exports, and network access for IMAP/SMTP—but declares no permissions or safeguards. This makes the trust boundary opaque and can lead to silent overreach, especially because the skill handles mailbox contents, attachments, and outbound email actions.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The summarize command intentionally scans email bodies for verification-related keywords and extracts 4-6 digit codes, then surfaces them in the report. This goes beyond normal summarization into credential harvesting behavior, increasing the likelihood of exposing one-time passwords or login secrets in downstream logs, transcripts, or agent outputs.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The README explicitly promotes automatic local storage of all emails, structured data, and attachments, but does not clearly warn users about retention, access control, or the sensitivity of cached mailbox contents on disk. In a mail-management skill, this creates a real privacy and security risk because local caches may expose highly sensitive messages and attachments to other local users, backups, logs, or malware.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The README advertises capabilities to send, delete, move, and mark emails without prominently warning that these actions are externally visible or potentially destructive. In an agent-integrated skill, insufficient caution increases the chance of accidental outbound messages, unintended deletions, or mailbox changes initiated by a misunderstood prompt or automation flow.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The invocation language is very broad and could cause the skill to trigger for generic email-related requests, including ones that may imply sensitive operations like reading, sending, deleting, or moving messages. Over-broad activation increases the chance of unintended access to mailbox data or execution of destructive actions without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill advertises high-impact actions—sending, deleting, moving, and exporting emails—without prominent warnings about privacy, persistence, or irreversible effects. In an email context, these operations can expose sensitive content, leak locally indexed mail, or alter a user's mailbox state, making the lack of explicit user-facing safety constraints materially dangerous.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The delete command performs irreversible server-side deletion based on a message ID without any confirmation step, preview, or safety interlock. In an agent setting, this raises the risk of accidental or prompt-induced destructive actions against the user's mailbox.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The export command writes potentially sensitive mailbox contents to any caller-supplied output path with no path restrictions, disclosure, or confirmation. In an agent context, this can facilitate unintended data exfiltration to shared locations or overwriting of local files if the path is influenced by untrusted instructions.

Ssd 3

High
Confidence
99% confidence
Finding
The code deliberately extracts and displays login verification codes from email bodies, which are highly sensitive authentication artifacts. In an LLM/agent workflow, exposing these codes in summaries materially increases the chance of credential theft, unauthorized account access, or leakage through logs and conversation history.

Unpinned Dependencies

Low
Category
Supply Chain
Content
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0
Confidence
96% confidence
Finding
imap-tools>=1.5.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0
Confidence
98% confidence
Finding
python-dotenv>=1.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0
Confidence
95% confidence
Finding
beautifulsoup4>=4.12.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0
Confidence
99% confidence
Finding
jinja2>=3.1.0

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
86% confidence
Finding
python-dotenv

Known Vulnerable Dependency: jinja2 — 10 advisory(ies): CVE-2019-10906 (Jinja2 sandbox escape via string formatting); CVE-2014-1402 (Incorrect Privilege Assignment in Jinja2); CVE-2025-27516 (Jinja2 vulnerable to sandbox breakout through attr filter selecting format metho) +7 more

High
Category
Supply Chain
Confidence
95% confidence
Finding
jinja2

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.