Security audit

Mail Skill

Security checks for vulnerabilities and agentic risk

Overview

This Exchange mail skill mostly matches its stated purpose, but it handles mailbox credentials and attachment downloads in ways users should review carefully before installing.

Install only if you trust the publisher and are comfortable giving the skill full Exchange mailbox authority. Use a least-privilege mailbox if possible, protect or avoid the .env.credentials file, do not reuse non-Exchange passwords, and avoid downloading attachments from untrusted senders until filename sanitization is fixed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation describes capabilities that imply access to environment variables, local files, and attachment download paths, yet no explicit permissions are declared. In an agent environment, undeclared access to env, file read/write, or shell-like capabilities weakens transparency and can let a high-privilege skill handle sensitive data without clear user or platform review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior goes beyond normal Exchange operations by reading and writing credential material, persisting user-supplied passwords, and invoking an external DWS subprocess to discover the email address. This is dangerous because it expands the trust boundary from mailbox actions to local secret storage and command execution, increasing the risk of credential theft, unintended persistence, or abuse of the subprocess path.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The skill reaches outside its declared Exchange/EWS scope to query another local identity source (DWS) for the user's email address. That cross-system data access increases the privilege and privacy footprint of the skill and creates an implicit dependency the user may not expect.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code reuses PICARD_PASSWORD as an Exchange credential fallback, crossing credential boundaries between unrelated systems. Reusing a non-Exchange secret for Exchange authentication can cause unauthorized secret propagation, unexpected account access attempts, and broader compromise if one secret is exposed or misapplied.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill updates the credential file to persist the Exchange password in plaintext, without any clear consent, encryption, or file-permission hardening. Persisting mailbox credentials this way materially increases the risk of local credential theft and silent long-term reuse.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Attachment names are written directly to disk via os.path.join(download_path, attachment.name) with no sanitization or path normalization checks. A crafted attachment name could perform path traversal or overwrite arbitrary files under the agent's privileges, and the write happens without strong user-facing disclosure.

Static analysis

No suspicious patterns detected.