Agent email (Mails.ai)

• Outcome: Review
• Latest audit: Sep 22, 2026 · 6:29 PM UTC
• Version: 1.0.0

Overview

This email skill is coherent, but should be reviewed because it runs an unpinned npm MCP server with access to an email API key.

Install only if you are comfortable granting this MCP server access to send and read mail through Mails.ai. Prefer a test key first, consider pinning or otherwise verifying the npm package version before use, and use a live key only for mailboxes and outbound workflows you intend the agent to control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: mailsai-email
description: Give your agent a real email address it can send from, receive at, and reply in-thread — with an injection scan on every inbound and a dry-run sandbox before anything transmits.
version: 1.0.0
metadata:
  openclaw:
    requires:
      env:
        - MAILS_API_KEY
      bins:
        - node
    primaryEnv: MAILS_API_KEY
    envVars:
      - name: MAILS_API_KEY
        required: true
        description: Mails.ai API key. Keys beginning mk_test_ run the full pipeline in sandbox mode and never transmit a message.
      - name: MAILS_BASE_URL
        required: false
        descript

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs users to execute `npx -y @mailsai/mcp-server` without pinning a specific package version, which creates a supply-chain risk: a future compromised or malicious release would be fetched and executed immediately. Because this package is started with access to `MAILS_API_KEY` and can send/receive email, compromise could expose secrets or enable unauthorized email actions.

Static analysis

No suspicious patterns detected.