ClawHub
Back to skill

Security audit

AgentSend Email

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AgentSend email integration, but users should understand it installs an external MCP package and may store AgentSend credentials locally.

Install this only if you want the agent to manage an AgentSend inbox. Treat the AgentSend API key and ~/.agentsend/credentials.json as sensitive, use an account or sandbox you can revoke, review or pin the @agentsend/mcp runtime where possible, and confirm message recipients, content, and webhook URLs before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding

Unpinned External MCP Dependency Handles Credentials and Sensitive Email Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6 and 13–16
Vulnerability Type: Unpinned third-party runtime dependency and unverifiable credential handling
Risk Level: Medium

Vulnerable Code

markdown
metadata: {"openclaw":{"emoji":"📧","homepage":"https://agentsend.io/skill","primaryEnv":"AGENTSEND_API_KEY","install":[{"id":"node","kind":"node","package":"@agentsend/mcp","bins":["agentsend-mcp"],"label":"Install AgentSend MCP"}]}}
markdown
## Runtime

- The runtime is `@agentsend/mcp`.
- `AGENTSEND_API_KEY` is optional. If it is set, use that account.
- If `AGENTSEND_API_KEY` is not set, the MCP server auto-provisions a sandbox account on first run and stores credentials in `~/.agentsend/credentials.json`.

Technical Analysis

The Skill installs and executes the external npm package @agentsend/mcp without specifying an exact version or integrity hash. Because the project contains only SKILL.md, the runtime implementation is not available for review. Its network behavior, local file access, credential-file permissions, and email-data handling therefore cannot be verified from the audited artifact.

An unpinned dependency may resolve to a different release on later installations. If the upstream package, publisher account, or distribution process is compromised, altered runtime code could be delivered after this Skill has been reviewed. The runtime operates in a sensitive context: it can receive AGENTSEND_API_KEY, read email bodies and headers, send email, register webhooks, and persist credentials under the user's home directory.

Persisting credentials in ~/.agentsend/credentials.json is functionally related to maintaining the declared email account and does not independently demonstrate malicious behavior or excessive privilege. However, the Skill does not specify restrictive file permissions, encryption, expiration, revocation, deletion, or explicit consent before automat ...[truncated 2086 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @agentsend/mcp to a reviewed, exact version rather than allowing package resolution to select a later release.
  2. Enforce package integrity verification using a trusted lockfile, registry integrity hash, or equivalent reproducible-installation mechanism.
  3. Publish or link the runtime source and identify the reviewed source revision corresponding to the pinned package.
  4. Document all network endpoints contacted by the runtime and restrict outbound access to required AgentSend endpoints where sandboxing is available.
  5. Run the MCP server under a dedicated, least-privileged account or sandbox with access limited to required files and network resources.
  6. Require explicit user confirmation before automatically provisioning an account or writing persistent credentials.
  7. Create ~/.agentsend/credentials.json with owner-only permissions, such as mode 0600 on supported systems, and ensure its parent directory is not accessible to other users.
  8. Document credential lifetime, revocation, rotation, and secure deletion procedures. Avoid storing credentials in plaintext when a platform credential store is available.
  9. Avoid passing secrets through command-line arguments or logs, and redact API keys and email content from diagnostic output.
  10. Require user confirmation for externally consequential operations, particularly sending email and registering or changing webhooks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (5)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: agentsend-email
description: Give your OpenClaw agent its own email inbox. Use AgentSend to create inboxes, send and receive email, inspect threads, and register webhooks.
homepage: https://agentsend.io/skill
metadata: {"openclaw":{"emoji":"📧","homepage":"https://agentsend.io/skill","primaryEnv":"AGENTSEND_API_KEY","install":[{"id":"node","kind":"node","package":"@agentsend/mcp","bins":["agentsend-mcp"],"label":"Install AgentSend MCP"}]}}
---

# AgentSend Email

Use AgentSend whenever the user wants the agent to have its own email inbox, send or receive email, inspect conversations, or register email webho

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
- The runtime is `@agentsend/mcp`.
- `AGENTSEND_API_KEY` is optional. If it is set, use that account.
- If `AGENTSEND_API_KEY` is not set, the MCP server auto-provisions a sandbox account on first run and stores credentials in `~/.agentsend/credentials.json`.
- Humans can learn the setup flow at [agentsend.io/skill](https://agentsend.io/skill) or create a permanent account at [agentsend.io/auth/signup](https://agentsend.io/auth/signup).

## Tools

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: agentsend-email
description: Give your OpenClaw agent its own email inbox. Use AgentSend to create inboxes, send and receive email, inspect threads, and register webhooks.
homepage: https://agentsend.io/skill
metadata: {"openclaw":{"emoji":"📧","homepage":"https://agentsend.io/skill","primaryEnv":"AGENTSEND_API_KEY","install":[{"id":"node","kind":"node","package":"@agentsend/mcp","bins":["agentsend-mcp"],"label":"Install AgentSend MCP"}]}}
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The invocation guidance says to use AgentSend whenever the user wants the agent to have an inbox, send or receive email, inspect conversations, or register webhooks, but it does not define boundaries or exclusions. This broad wording may cause unintended invocation for ordinary email-related discussion or tasks that do not require this specific skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill states that a sandbox account is auto-provisioned and credentials are stored locally in ~/.agentsend/credentials.json, but it does not clearly warn the user before this persistence occurs. That can lead to unanticipated secret creation and storage on disk, increasing the risk of credential exposure on shared, synced, or weakly protected systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.