ClawHub
Back to skill

Security audit

mail-skill

Security checks for vulnerabilities and agentic risk

Overview

This email skill does what it says, but it needs review because it can change mailbox state, store full mail locally, expose verification codes, and save attachments unsafely.

Install only if you are comfortable giving the agent mailbox access. Use an app-specific mail password, protect or encrypt the mail_data directory, avoid broad fetches, require manual approval before send/delete/move/export actions, and patch attachment filename handling and verification-code redaction before fetching untrusted mail.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (16)

Tainted flow: 'att_path' from os.getenv (line 142, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
for att in email_data['attachments']:
                    if att.filename:
                        att_path = os.path.join(att_dir, att.filename)
                        with open(att_path, 'wb') as f:
                            f.write(att.payload)
                        db_attachments.append({
                            'filename': att.filename,
Confidence
99% confidence
Finding
Attachment filenames are written directly with os.path.join(att_dir, att.filename) and are not sanitized or canonicalized. A malicious email attachment name containing path separators or traversal sequences could cause files to be written outside the intended attachment directory, potentially overwriting arbitrary files accessible to the process.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly exercises sensitive capabilities—environment access for credentials, local file read/write for stored mail and exports, and network access for IMAP/SMTP—but declares no permissions or safeguards. This makes the trust boundary opaque and can lead to silent overreach, especially because the skill handles mailbox contents, attachments, and outbound email actions.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The summarize command intentionally scans email bodies for verification-related keywords and extracts 4-6 digit codes, then surfaces them in the report. This goes beyond normal summarization into credential harvesting behavior, increasing the likelihood of exposing one-time passwords or login secrets in downstream logs, transcripts, or agent outputs.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The README explicitly promotes automatic local storage of all emails, structured data, and attachments, but does not clearly warn users about retention, access control, or the sensitivity of cached mailbox contents on disk. In a mail-management skill, this creates a real privacy and security risk because local caches may expose highly sensitive messages and attachments to other local users, backups, logs, or malware.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The README advertises capabilities to send, delete, move, and mark emails without prominently warning that these actions are externally visible or potentially destructive. In an agent-integrated skill, insufficient caution increases the chance of accidental outbound messages, unintended deletions, or mailbox changes initiated by a misunderstood prompt or automation flow.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The invocation language is very broad and could cause the skill to trigger for generic email-related requests, including ones that may imply sensitive operations like reading, sending, deleting, or moving messages. Over-broad activation increases the chance of unintended access to mailbox data or execution of destructive actions without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill advertises high-impact actions—sending, deleting, moving, and exporting emails—without prominent warnings about privacy, persistence, or irreversible effects. In an email context, these operations can expose sensitive content, leak locally indexed mail, or alter a user's mailbox state, making the lack of explicit user-facing safety constraints materially dangerous.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The delete command performs irreversible server-side deletion based on a message ID without any confirmation step, preview, or safety interlock. In an agent setting, this raises the risk of accidental or prompt-induced destructive actions against the user's mailbox.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The export command writes potentially sensitive mailbox contents to any caller-supplied output path with no path restrictions, disclosure, or confirmation. In an agent context, this can facilitate unintended data exfiltration to shared locations or overwriting of local files if the path is influenced by untrusted instructions.

Ssd 3

High
Confidence
99% confidence
Finding
The code deliberately extracts and displays login verification codes from email bodies, which are highly sensitive authentication artifacts. In an LLM/agent workflow, exposing these codes in summaries materially increases the chance of credential theft, unauthorized account access, or leakage through logs and conversation history.

Unpinned Dependencies

Low
Category
Supply Chain
Content
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0
Confidence
96% confidence
Finding
The dependency is specified with a lower bound only, which allows installation of any newer version, including unexpected major releases or compromised packages introduced later in the supply chain. While not an exploit by itself, unpinned dependencies reduce build reproducibility and increase exposure to vulnerable or malicious upstream updates.

Unpinned Dependencies

Low
Category
Supply Chain
Content
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0
Confidence
98% confidence
Finding
python-dotenv is unpinned, so deployments may resolve to different versions over time, including versions affected by published advisories. In this skill, which likely handles local configuration and credentials for mail accounts, unstable dependency resolution increases supply-chain risk around sensitive environment handling.

Unpinned Dependencies

Low
Category
Supply Chain
Content
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0
Confidence
95% confidence
Finding
beautifulsoup4 is declared with a minimum version only, which weakens reproducibility and permits unreviewed future releases to be installed. This is a supply-chain hygiene issue rather than direct evidence of exploitable behavior in the file itself.

Unpinned Dependencies

Low
Category
Supply Chain
Content
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0
Confidence
99% confidence
Finding
jinja2 is unpinned, so the environment may install versions with known sandbox-escape and template-related security issues. In an email-management skill, templating is plausibly used for message generation or rendering, making dependency drift materially riskier if any user-controlled data reaches templates.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
86% confidence
Finding
The requirements file includes python-dotenv without constraining it away from a version with a published advisory involving symlink following in set_key, which can enable arbitrary file overwrite in certain usage patterns. The danger depends on whether the skill actually calls set_key on attacker-influenced paths, but as a mail skill handling local config and secrets, the package is sensitive enough that this should be treated as a real risk.

Known Vulnerable Dependency: jinja2 — 10 advisory(ies): CVE-2019-10906 (Jinja2 sandbox escape via string formatting); CVE-2014-1402 (Incorrect Privilege Assignment in Jinja2); CVE-2025-27516 (Jinja2 vulnerable to sandbox breakout through attr filter selecting format metho) +7 more

High
Category
Supply Chain
Confidence
95% confidence
Finding
The requirements include jinja2, and multiple published advisories exist for vulnerable versions, including sandbox escape and breakout issues. In a mail skill, templating is a common feature for composing or formatting messages, so if templates or template expressions can be influenced by users or email content, exploitation could lead to code execution or sensitive data exposure.

Static analysis

No suspicious patterns detected.