T08 · Insecure Dependencies
Warning
- Location
package.json:12- Finding
Declared vendored dependency is absent from the distributed project
- Content
View full analysis
- Remediation
View remediation
Security audit
☤CaduceusMail
Security checks for vulnerabilities and agentic risk
Overview
The skill’s mail and DNS automation purpose is disclosed, but it would use high-value credentials with a missing unaudited vendored CLI and broader-than-necessary environment forwarding.
Install only after the exact vendored caduceusmail tarball is included and audited against the manifest. Use a dedicated least-privilege Entra service principal and Cloudflare DNS token, and avoid placing unrelated secrets in OPENCLAW_*, CADUCEUSMAIL_*, or EMAIL_ALIAS_FABRIC_* environment variables.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/ensure-caduceusmail.sh:77- Finding
Cached executable is trusted without validating its installed contents
- Content
View full analysis
/dev/null import json import pathlib import sys install_dir = pathlib.Path(sys.argv[1]) expected_name = sys.argv[2] expected_version = sys.argv[3] expected_integrity = sys.argv[4] package_json = install_dir / "package" / "package.json" release_json = install_dir / ".release.json" if not package_json.exists() or not release_json.exists(): raise SystemExit(1) package_meta = json.loads(package_json.read_text(encoding="utf-8")) release_meta = json.loads(release_json.read_text(encoding="utf-8")) if package_meta.get("name") != expected_name or package_meta.get("version") != expected_version: raise SystemExit(1) if release_meta.get("integrity") != expected_integrity: raise SystemExit(1) PY } ``` The accepted cached entrypoint is subsequently executed: ```bash exec env -i "${ENV_ARGS[@]}" node "${ENTRYPOINT}" "$@" ``` ### Technical Analysis The original archive is hashed before extraction, but subsequent executions do not verify the installed files against that archive. `installed_release_is_valid()` checks only: - Whether the entrypoint exists. - Whether `package/package.json` contains the expected name and version. - Whether `.release.json` contains the expected integrity string. The integrity string in `.release.json` is copied metadata; it is not a digest of the current extracted files. A process capable of modifying the same user's cache can replace `package/dist/cli.js` while leaving `package.json` and `.release.json` unchanged. The modified entrypoint then passes validation and is executed. The use o ...[truncated 1435 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.sh:39- Finding
Wildcard environment forwarding exposes variables beyond the documented minimum
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description emphasizes communications automation, but the skill also installs/extracts a vendored toolchain, verifies release artifacts, and manages local runtime state. This mismatch can mislead reviewers and users about the true execution and persistence behavior, reducing informed consent and increasing the chance that a powerful bootstrap/install workflow is approved without adequate scrutiny.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares no explicit tool scope despite clearly requiring shell execution and filesystem read/write behavior via the wrapper and extraction flow. In a high-privilege mail/DNS automation skill, missing permission declarations weakens reviewability and policy enforcement, making it easier for an operator or platform to grant broader capabilities than intended.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh ensure_private_dir() { mkdir -p "$1" chmod 700 "$1" 2>/dev/null || true } add_if_set() {
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh ensure_private_dir() { mkdir -p "$1" chmod 700 "$1" 2>/dev/null || true } add_if_set() {
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh ensure_private_dir "${STATE_ROOT}" ensure_private_dir "${INTEL_DIR}" if [[ -f "${ENV_FILE}" ]]; then chmod 600 "${ENV_FILE}" 2>/dev/null || true fi ENTRYPOINT="$(bash "${SCRIPT_DIR}/ensure-caduceusmail.sh")"
Static analysis
No suspicious patterns detected.