T09 · Insecure Skill Coding Practices
Error
- Location
__init__.py:465- Finding
Attachment Filename Path Traversal Enables Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Mail Skill
Security checks for vulnerabilities and agentic risk
Overview
This Exchange mailbox skill is broadly purpose-aligned, but it asks for mailbox passwords in chat, stores them in local credential files, reuses an unrelated password variable, and has an unsafe attachment download path.
Review carefully before installing. Use only a dedicated Exchange password or token, avoid sending passwords in chat, restrict the credential file, confirm any mail/calendar mutations, and do not download attachments until filenames are sanitized or downloads are constrained to a safe directory.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
__init__.py:174- Finding
Cross-Service Password Reuse Can Transmit a Login Secret to a Configurable Exchange Server
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:204- Finding
Unpinned Runtime Dependency Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented purpose focuses on EWS mailbox management, but the described behavior extends into local credential persistence, authentication state management, and external subprocess execution via DWS. That mismatch is dangerous because reviewers and runtime policy may authorize the skill for email tasks while overlooking hidden high-risk capabilities that can expose credentials or expand access beyond expected mailbox operations.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs the agent to ask the user to provide their email password in chat and then store it using an update function. Collecting secrets through conversational channels is unsafe because chats are often logged, retained, inspected by systems or operators, and can lead to credential theft or replay; storing the password locally compounds the risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The English setup section repeats an unsafe pattern of prompting for a mailbox password via conversation and persisting the submitted secret as stored credentials. In the context of a skill with full mailbox access, this creates a strong chance of credential compromise and broad downstream exposure of email, calendar, contacts, and delegated mailboxes.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code explicitly instructs the user to provide their email password in chat so the assistant can update configuration and retry access. Requesting secrets through a conversational channel is dangerous because chats are often logged, retained, or accessible to intermediaries, turning mailbox credentials into easily exposed plaintext.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The function documentation normalizes the pattern of accepting a user's password and saving it for future use. That codifies insecure secret handling into the skill's intended workflow, increasing the likelihood that operators and downstream agents will solicit and retain plaintext credentials.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill persists a newly provided Exchange password to local storage without a clear user-facing warning about secret retention. Storing a mailbox password for reuse is highly sensitive because compromise of that file or environment can lead to full mailbox access and possible reuse against other corporate systems.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises broad Exchange capabilities but does not declare any explicit tool or permission boundaries despite requiring access patterns consistent with environment data, file I/O, and shell execution. In an agent setting, missing scope declarations weakens policy enforcement and makes it harder to constrain sensitive actions such as credential handling and external command invocation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill reaches outside Exchange/EWS and queries an external DWS CLI to discover the user's identity. That broadens access to unrelated enterprise identity data and creates an unnecessary trust dependency on another local tool, which is risky in a credentialed skill handling sensitive mailboxes.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def _fetch_email_from_dws(): """Call dws contact user get-self to get the user's email.""" try: result = subprocess.run( ['dws', 'contact', 'user', 'get-self', '--format', 'json'], capture_output=True, text=True, timeout=15 )
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code reads and rewrites local credential files, including modifying stored mailbox credentials. Persisting and mutating secrets in flat files materially increases the chance of credential disclosure, tampering, and unintended reuse beyond the immediate Exchange operation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Importing an Exchange password from an unrelated PICARD_PASSWORD environment variable expands credential access beyond the skill's stated purpose. This can cause secret confusion and unauthorized cross-use of credentials from another subsystem, violating least privilege and increasing exposure of sensitive account passwords.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The attachment download path is written directly to disk with no user confirmation, path safety checks, or filename sanitization. A malicious attachment name could exploit path traversal or overwrite files if the server-supplied filename contains unsafe path components.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Calendar and scheduling functions force the Asia/Shanghai time zone, which can produce incorrect behavior for users in other locales and violates the requirement not to force a locale without opt-in. The file provides no user-selectable locale setting or justification for the constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file presents core setup instructions in both Chinese and English, but the Chinese section appears first and there is no statement about user language preference, opt-in, or intended locale scope. Under the policy rule, forcing or assuming a language/locale without user choice can be a natural-language policy issue unless clearly justified as region-specific.
- Content