☤CaduceusMail

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:01 AM UTC
• Version: 3.6.7

Overview

The skill’s mail and DNS automation purpose is disclosed, but it would use high-value credentials with a missing unaudited vendored CLI and broader-than-necessary environment forwarding.

Install only after the exact vendored caduceusmail tarball is included and audited against the manifest. Use a dedicated least-privilege Entra service principal and Cloudflare DNS token, and avoid placing unrelated secrets in OPENCLAW_*, CADUCEUSMAIL_*, or EMAIL_ALIAS_FABRIC_* environment variables.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: package.json:12
• Finding: Declared vendored dependency is absent from the distributed project<![CDATA[ ## Vulnerability Details **File Location**: `package.json:12-14`, `vendor/caduceusmail-release.json:2-6`, `scripts/ensure-caduceusmail.sh:51-52, 63-68` **Vulnerability Type**: Missing security-critical vendored dependency and incomplete supply-chain verification **Risk Level**: Medium ### Complete Code Snippet ```json "dependencies": { "caduceusmail": "file:vendor/caduceusmail-3.6.7.tgz" } ``` ```json { "name": "caduceusmail", "version": "3.6.7", "filename": "caduceusmail-3.6.7.tgz", "integrity": "sha512-fv4cj8iFUM7yE9GSqDigiwm3MVgcJjxikp03hQGHqjFbEseoLS0UnooreIF7pg+LGbqpyecvF35sJitaGpghAg==", "shasum": "aa74eaf1f8e24b394846bd176014458acc485065" } ``` ```bash PACKAGE_TARBALL="${SKILL_DIR}/vendor/${PACKAGE_FILENAME}" INSTALL_DIR="${INSTALL_ROOT}/${PACKAGE_NAME}-${PACKAGE_VERSION}" verify_vendored_release() { python3 - "${PACKAGE_TARBALL}" "${PACKAGE_INTEGRITY}" "${PACKAGE_SHASUM}" <<'PY' import base64 import hashlib import pathlib import sys tarball = pathlib.Path(sys.argv[1]) expected_integrity = sys.argv[2] expected_shasum = sys.argv[3] payload = tarball.read_bytes() ``` ### Technical Analysis The project declares `vendor/caduceusmail-3.6.7.tgz` as both a local package dependency and the executable release artifact. The audited directory contains only `vendor/caduceusmail-release.json`; the referenced tarball is absent. Consequently, the integrity check fails when `tarball.read_bytes()` attempts to open the missing file, and the Skill cannot execute as distributed. The omitted archive is also the component that would receive Entra, Exchange, and Cloudflare credentials and perform the principal network and infrastructure operations. Its credential handling, network destinations, and mutation behavior could not be audited. The manifest contains expected hashes, which would protect against an unmodified manifest paired with an incorrect archive. However, users may be encouraged to obtain the missing component separately, creating ...[truncated 1296 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the exact `vendor/caduceusmail-3.6.7.tgz` artifact referenced by the manifest and `package.json`. 2. Add a packaging or CI check that fails when the archive is absent. 3. Recompute SHA-512 and SHA-1 values during CI and compare them against independently maintained release metadata. 4. Publish provenance information, a full immutable commit identifier, and reproducible-build instructions for the archive. 5. Audit the archive contents, especially network endpoints, credential handling, persistence, subprocess execution, and Microsoft/Cloudflare permission use. 6. Do not instruct users to download the missing artifact manually from an unverified location. 7. Consider signing the release manifest and archive with a trusted release key so replacement of both files is detectable. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/ensure-caduceusmail.sh:77
• Finding: Cached executable is trusted without validating its installed contents<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ensure-caduceusmail.sh:77-99`; execution occurs at `scripts/run.sh:61` **Vulnerability Type**: Cached tool replacement and insufficient integrity validation **Risk Level**: Medium ### Complete Code Snippet ```bash installed_release_is_valid() { [[ -f "${ENTRYPOINT}" ]] || return 1 python3 - "${INSTALL_DIR}" "${PACKAGE_NAME}" "${PACKAGE_VERSION}" "${PACKAGE_INTEGRITY}" <<'PY' >/dev/null import json import pathlib import sys install_dir = pathlib.Path(sys.argv[1]) expected_name = sys.argv[2] expected_version = sys.argv[3] expected_integrity = sys.argv[4] package_json = install_dir / "package" / "package.json" release_json = install_dir / ".release.json" if not package_json.exists() or not release_json.exists(): raise SystemExit(1) package_meta = json.loads(package_json.read_text(encoding="utf-8")) release_meta = json.loads(release_json.read_text(encoding="utf-8")) if package_meta.get("name") != expected_name or package_meta.get("version") != expected_version: raise SystemExit(1) if release_meta.get("integrity") != expected_integrity: raise SystemExit(1) PY } ``` The accepted cached entrypoint is subsequently executed: ```bash exec env -i "${ENV_ARGS[@]}" node "${ENTRYPOINT}" "$@" ``` ### Technical Analysis The original archive is hashed before extraction, but subsequent executions do not verify the installed files against that archive. `installed_release_is_valid()` checks only: - Whether the entrypoint exists. - Whether `package/package.json` contains the expected name and version. - Whether `.release.json` contains the expected integrity string. The integrity string in `.release.json` is copied metadata; it is not a digest of the current extracted files. A process capable of modifying the same user's cache can replace `package/dist/cli.js` while leaving `package.json` and `.release.json` unchanged. The modified entrypoint then passes validation and is executed. The use o ...[truncated 1435 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the installed content before every execution rather than trusting copied metadata. 2. Prefer extracting a fresh copy from the verified archive into a private temporary directory and executing that copy. 3. Alternatively, maintain a signed manifest containing a digest for every extracted file and reject missing, modified, or unexpected files. 4. Validate ownership and permissions for the installation root, all parent directories, the entrypoint, and metadata files. 5. Reject symlinks and other special files throughout the installed tree. 6. Install atomically into a versioned, immutable directory and avoid making validated installations writable during normal operation. 7. If the runtime platform supports it, use read-only mounts or filesystem immutability controls for the installed toolchain. 8. Revalidate the source archive immediately before reinstallation and avoid relying on `.release.json` as proof of current file integrity. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run.sh:39
• Finding: Wildcard environment forwarding exposes variables beyond the documented minimum<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.sh:39-46` **Vulnerability Type**: Overbroad transmission of potentially sensitive environment variables **Risk Level**: Medium ### Complete Code Snippet ```bash while IFS='=' read -r name _; do case "${name}" in CADUCEUSMAIL_*|EMAIL_ALIAS_FABRIC_*|OPENCLAW_*) add_if_set "${name}" ;; esac done < <(env) ``` ### Technical Analysis The wrapper correctly starts the child process with `env -i`, but it then forwards every environment variable matching three broad namespaces. This is not a strict least-privilege allowlist. Variables under `OPENCLAW_*`, `CADUCEUSMAIL_*`, or `EMAIL_ALIAS_FABRIC_*` may include unrelated access tokens, internal endpoints, debugging values, future secrets, or host-specific state. Such values are automatically exposed to the vendored CLI even if they are unnecessary for the selected operation. This behavior is broader than the explicit Microsoft and Cloudflare variable list elsewhere in the wrapper. The risk becomes more significant if the vendored dependency is malicious, compromised, or replaced in the local cache. The static pre-scan concerns about sensitive network transmission cannot be fully resolved because the executable archive is absent, but the wrapper demonstrably expands the set of data available to that unaudited executable. ### Attack Path 1. The host environment contains a sensitive variable whose name matches `OPENCLAW_*`, `CADUCEUSMAIL_*`, or `EMAIL_ALIAS_FABRIC_*`. 2. The user invokes `scripts/run.sh`. 3. The wildcard loop adds the sensitive variable to `ENV_MAP` without determining whether the current subcommand requires it. 4. `env -i` starts the Node.js CLI with that variable included. 5. A compromised, substituted, or vulnerable CLI reads the unnecessary value. 6. Because the declared functionality involves outbound Microsoft and Cloudflare communications, malicious code could transmit the value to an attacker-controlled servi ...[truncated 433 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all namespace wildcards with a strict, documented allowlist of individual variable names. 2. Define separate allowlists per CLI subcommand so each operation receives only the credentials and configuration it requires. 3. Do not forward general `OPENCLAW_*` variables unless each variable has a demonstrated functional requirement. 4. Separate non-secret configuration from credentials and pass secrets through a dedicated secret-injection mechanism where possible. 5. Document every forwarded variable, its purpose, expected sensitivity, and destination. 6. Add tests that populate unrelated variables in each namespace and confirm that they are absent from the child process. 7. Ensure diagnostic and error output never prints forwarded values. 8. Audit the underlying CaduceusMail CLI before granting it any high-value environment variables. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description emphasizes communications automation, but the skill also installs/extracts a vendored toolchain, verifies release artifacts, and manages local runtime state. This mismatch can mislead reviewers and users about the true execution and persistence behavior, reducing informed consent and increasing the chance that a powerful bootstrap/install workflow is approved without adequate scrutiny.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no explicit tool scope despite clearly requiring shell execution and filesystem read/write behavior via the wrapper and extraction flow. In a high-privilege mail/DNS automation skill, missing permission declarations weakens reviewability and policy enforcement, making it easier for an operator or platform to grant broader capabilities than intended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ensure_private_dir() {
  mkdir -p "$1"
  chmod 700 "$1" 2>/dev/null || true
}

add_if_set() {

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ensure_private_dir() {
  mkdir -p "$1"
  chmod 700 "$1" 2>/dev/null || true
}

add_if_set() {

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ensure_private_dir "${STATE_ROOT}"
ensure_private_dir "${INTEL_DIR}"
if [[ -f "${ENV_FILE}" ]]; then
  chmod 600 "${ENV_FILE}" 2>/dev/null || true
fi

ENTRYPOINT="$(bash "${SCRIPT_DIR}/ensure-caduceusmail.sh")"

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.