ClawHub
Back to skill

Security audit

mail-skill

Security checks for vulnerabilities and agentic risk

Overview

This mail skill mostly matches its stated email-management purpose, but it has unsafe file handling and high-impact mail actions without enough safeguards.

Review carefully before installing. Use only with a dedicated mail account or app password, restrict filesystem permissions on the mail_data directory, avoid autonomous send/delete/export actions, and do not fetch untrusted attachments until filename containment is fixed. Treat verification-code summaries as sensitive authentication material.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mail_cli.py:138
Finding

Arbitrary File Write Through Untrusted Attachment Filenames

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/mail_cli.py:208
Finding

Task Identifier Path Traversal Permits Unauthorized JSON File Disclosure

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unpinned and Unhashed Third-Party Dependencies Prevent Reproducible Installation

Content
View full analysis
=1.5.0 python-dotenv>=1.0.0 beautifulsoup4>=4.12.0 jinja2>=3.1.0 ``` ### Technical Analysis Every dependency uses an open-ended minimum version rather than an exact reviewed version. Consequently, separate installations can resolve to different package releases, including releases published after the Skill audit. No package hashes or lock file are provided to verify artifact integrity. The reviewed source also does not import or otherwise use `jinja2`, so this dependency unnecessarily expands the installation and runtime attack surface. This finding does not establish that any listed package is currently malicious or vulnerable. The risk is the absence of reproducible, integrity-checked dependency resolution. ### Attack Path 1. A user follows the documented installation command, `pip install -r requirements.txt`. 2. The package resolver selects any available versions satisfying the open-ended `>=` constraints. 3. A newly released, compromised, or behaviorally incompatible dependency version may be selected. 4. Dependency installation or import executes code that was not part of the reviewed Skill snapshot. 5. The resulting environment may exhibit security behavior different from the audited version. ### Impact Assessment If an upstream package or distribution channel is compromised, dependency code executes with the privileges of the user installing or running the Skill. Such code could access configured mail credentials, local email content, attachments, and any other resources available to that account. The current evidence only confirms weak supply-chain controls, not an active dependency compromise. Accordingly, the finding is rated Low. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (30)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

This finding shows the skill claims broad email indexing, search, reply, and summarization features that are not consistently represented in the described implementation. Such overclaiming can mislead agents into relying on nonexistent safeguards or workflows and can mask the true handling of sensitive email content, especially when summarization and indexing imply additional retention and processing of private communications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

This finding shows the skill claims broad email indexing, search, reply, and summarization features that are not consistently represented in the described implementation. Such overclaiming can mislead agents into relying on nonexistent safeguards or workflows and can mask the true handling of sensitive email content, especially when summarization and indexing imply additional retention and processing of private communications.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_cli.py (reported line 28)May include surrounding context.

python
os.makedirs(TASKS_DIR, exist_ok=True)

def load_config():
    """Load configuration from .env file"""
    # Look for .env in the parent directory of scripts
    env_path = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), '.env')
    if os.path.exists(env_path):

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_cli.py (reported line 29)May include surrounding context.

python
os.makedirs(TASKS_DIR, exist_ok=True)

def load_config():
    """Load configuration from .env file"""
    # Look for .env in the parent directory of scripts
    env_path = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), '.env')
    if os.path.exists(env_path):

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_cli.py (reported line 30)May include surrounding context.

python
def load_config():
    """Load configuration from .env file"""
    # Look for .env in the parent directory of scripts
    env_path = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), '.env')
    if os.path.exists(env_path):
        load_dotenv(env_path)
    else:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
70% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/mail_cli.py (reported line 44)May include surrounding context.

python
}
    
    # Parse accounts
    for key, value in os.environ.items():
        if key.startswith('MAIL_ACCOUNT_') and key.endswith('_EMAIL'):
            account_prefix = key[:-6] # Remove _EMAIL
            account_id = account_prefix.split('_')[-1]

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mail_cli.py (reported line 64)May include surrounding context.

python
def get_client(config, email_account=None):
    if not config['ACCOUNTS']:
        raise ValueError("No mail accounts configured in .env")
        
    if email_account and email_account in config['ACCOUNTS']:
        account_config = config['ACCOUNTS'][email_account]

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The summarizer deliberately extracts and highlights verification codes from emails, effectively surfacing authentication secrets in a compact report. In an agent skill, this increases the chance that one-time codes or other credentials are exposed to unintended recipients, logs, downstream tools, or prompt-injected workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README describes local storage behavior and even mentions absolute attachment paths, but it does not explicitly warn that fetched emails, attachments, and metadata may be exposed to the agent itself and to other local users or processes with filesystem access. In a mail-management skill, this omission is security-relevant because email content commonly contains credentials, invoices, personal data, and sensitive business information, so users may underestimate the confidentiality risks of enabling the skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises and instructs use of capabilities that access environment secrets, local files, persistent storage, and networked email services, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope makes it easier for the skill to be invoked with overly broad privileges, increasing the risk of unauthorized mailbox access, credential exposure, or unintended file writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation description is so broad that the skill may trigger for many ordinary email-related requests without clear limits, causing an agent to use a high-privilege mail tool when a narrower or read-only action would suffice. In context, this is risky because the skill includes sensitive and destructive operations over live mailboxes, local storage, and outbound sending.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents destructive actions like move and delete without requiring confirmation or warning about irreversible consequences. In an email-management context, accidental or prompt-induced deletion/movement can cause loss of important records, disrupt business workflows, or hide evidence of communications.

Content

No source excerpt is available for this finding.

Tainted flow: 'eml_path' from os.getenv (line 129, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/mail_cli.py (reported line 130)May include surrounding context.

python
# Save EML
            eml_filename = "".join([c for c in email_data['message_id'] if c.isalpha() or c.isdigit() or c in '-_.']).rstrip() + '.eml'
            eml_path = os.path.join(paths['eml_path'], eml_filename)
            with open(eml_path, 'wb') as f:
                f.write(bytes(email_data['raw_email']))
            email_data['local_path_eml'] = eml_path

Tainted flow: 'att_path' from os.getenv (line 142, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
96% confidence
Finding

Attachment filenames are written directly with os.path.join(att_dir, att.filename) and no sanitization or path normalization check. A malicious email attachment name containing traversal sequences or absolute paths could escape the attachment directory and overwrite arbitrary files accessible to the process.

Content

Scanner excerpt · scripts/mail_cli.py (reported line 143)May include surrounding context.

python
for att in email_data['attachments']:
                    if att.filename:
                        att_path = os.path.join(att_dir, att.filename)
                        with open(att_path, 'wb') as f:
                            f.write(att.payload)
                        db_attachments.append({
                            'filename': att.filename,

Tainted flow: 'json_path' from os.getenv (line 155, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/mail_cli.py (reported line 163)May include surrounding context.

python
if 'date' in json_data and isinstance(json_data['date'], datetime):
                json_data['date'] = json_data['date'].isoformat()
                
            with open(json_path, 'w', encoding='utf-8') as f:
                json.dump(json_data, f, ensure_ascii=False, indent=2)
            email_data['local_path_json'] = json_path

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The send command can transmit arbitrary email bodies and local attachments immediately without any confirmation gate or warning. In an LLM-agent setting, prompt injection or misunderstanding could cause unintended outbound messages or attachment exfiltration on the user's behalf.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Deletion is destructive and irreversible from the local database perspective, yet the command performs server-side deletion immediately with no confirmation prompt. In an autonomous skill context, this raises the risk of accidental or induced data loss through prompt injection, ambiguity, or model error.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The export command allows dumping locally indexed emails to any user-specified path, including sensitive metadata and potentially full contents depending on search_emails output. In an agent skill context, this materially expands exfiltration capability beyond ordinary mail interaction and can persist sensitive mailbox data to attacker-chosen locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The export command writes sensitive mailbox data to an arbitrary file path without warning or confirmation. In an agent-driven environment, this can facilitate silent data staging or exfiltration to locations later read by other tools or users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The summarize command emits status text, headings, and guidance in Chinese only, which imposes a specific language on users without offering a choice. This is a natural-language locale policy issue because the skill does not provide opt-in, configuration, or documented justification for the forced language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code assembles outbound email content, recipients, and optional file attachments, then sends them over SMTP. Although the function has a docstring, it does not provide any user-facing disclosure, confirmation prompt, or visible logging that data and local files may be transmitted externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The method deletes emails from the selected folder, and the docstring notes deletion may be permanent depending on server behavior. However, there is no confirmation prompt, visible user disclosure, or user-facing log at the point of deletion to warn about possible irreversible effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README presents the skill instructions and usage information entirely in Chinese, which imposes a specific language on users without indicating an option to select another language. This can violate language/locale policy when no user opt-in or justified locale limitation is documented.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency specification for imap-tools uses a lower-bound-only version constraint, which allows future releases to be installed without review. This creates a supply-chain risk because a later incompatible or compromised release could be pulled into the skill unexpectedly.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

python-dotenv is not pinned and is allowed to resolve to any future version greater than or equal to 1.0.0. In a skill that may load local configuration and secrets, unpinned dependency resolution increases supply-chain exposure and makes it harder to determine whether vulnerable versions are in use.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
imap-tools>=1.5.0
python-dotenv>=1.0.0
beautifulsoup4>=4.12.0
jinja2>=3.1.0

Static analysis

No suspicious patterns detected.