Security audit

QQ Email Manager

Security checks for vulnerabilities and agentic risk

Overview

This email skill does what it claims, but it asks users to store mailbox credentials in a local plaintext config and can read, send, reply, forward, and mark email without extra safeguards.

Review this skill before installing if you will connect a real mailbox. Use a revocable app-specific password, restrict file permissions on the config, avoid committing or sharing the configured directory, and require explicit confirmation before the agent sends, replies, forwards, reply-alls, marks messages, or attaches local files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: config/email-config.json:11
Finding: Plaintext Storage of Email Credentials in a Project-Local Configuration File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes a Python email client that reads local configuration files and connects to IMAP/SMTP servers, but the manifest does not declare any tool scope or permissions. This creates a dangerous mismatch between the skill's documented interface and its actual capabilities, reducing reviewability and increasing the chance of unintended mailbox access, credential use, or network exfiltration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are broad and action-oriented, covering sensitive operations like reading, searching, replying to, forwarding, and sending email. Ambiguous activation raises the risk that ordinary conversation could unintentionally trigger mailbox access or outbound email actions without sufficiently clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description and usage guidance do not prominently warn users that the skill reads mailbox contents, sends email, and requires storage of mailbox credentials in a local configuration file. In a mail-management context, this omission is especially risky because it can expose sensitive communications and secrets while users may not appreciate the scope of access being granted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-facing natural-language strings throughout the script, including the module description, error messages, and CLI help, are exclusively in Chinese. There is no indication that the tool is region-specific or that users may opt into another language, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code performs SMTP transmission of email bodies, recipient lists, and optional attachments via send, reply, and forward commands. Although these actions are core functionality, the file lacks any explicit user disclosure such as a confirmation prompt, warning comment/docstring, or user-facing notice that content and attachments will be sent over the network and, for forward, redistributed to new recipients.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.