converting-email-templates

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:52 AM UTC
• Version: 1.0.0

Overview

This is a legitimate Mailtrap template converter, but it needs Review because its converter can overwrite source or existing files despite promising not to.

Install only if you are comfortable reviewing file-output behavior. Run it on copies or backups of templates, choose a dedicated empty output directory, and avoid pointing output at the source folder. Treat the Mailtrap curl snippets as examples to run manually with appropriately scoped tokens, especially delete/update operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/converter.py:565

Finding

Output Path Can Overwrite the Original Input Template

Content

View full analysis

Vulnerability Details

File Location: scripts/converter.py, lines 565-570
Vulnerability Type: Unsafe file overwrite
Risk Level: Medium

python

# Write converted file
output_path = output_dir / input_path.name
output_path.write_text(output_html, encoding="utf-8")

# Write report
report_path = output_dir / f"{input_path.stem}.report.txt"
report = generate_report(input_path.name, result)

Technical Analysis

The converter constructs the destination path by combining the user-controlled output directory with the input file's basename. It does not resolve and compare the source and destination paths before calling write_text().

If --output identifies the input file's parent directory, output_path resolves to the original input path. Python's Path.write_text() truncates an existing file before writing, so the source template is replaced by the converted output. This contradicts the guarantee in SKILL.md, line 137:

markdown

- **Never modify the original file.** Converted output always goes to the output directory.

The same behavior can overwrite another existing file with a matching basename in a different output directory. No confirmation, exclusive-create mode, backup, or explicit force option is required.

Attack Path

1. A user, automation process, or Agent invokes the converter with an input template.
2. The supplied output directory is the source template's parent directory, whether intentionally or through path normalization such as . or ...
3. output_dir / input_path.name resolves to the source file itself.
4. output_path.write_text() truncates and replaces the original template.
5. If conversion flags exist, the only source copy may be replaced with warning comments and commented-out template content.

An equivalent unintended overwrite occurs when the selected output directory already contains an unrelated file with the same basename.

Impact Assessment

Exploitation does not grant additional s ...[truncated 305 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve and compare the source and destination paths before writing:

python

input_resolved = input_path.resolve()
output_path = (output_dir / input_path.name).resolve()

if output_path == input_resolved:
    raise ValueError(
        "Output path resolves to the input file; refusing to overwrite the source."
    )

2. Refuse to replace any existing destination by default. Use exclusive creation, such as open("x", encoding="utf-8"), and add an explicit --force option if overwrite behavior is required.

3. Apply equivalent collision checks to generated report and summary paths.

4. Write to a temporary file in the destination directory and atomically rename it after successful conversion to reduce corruption risk from interrupted writes.

5. Add tests covering:

   • Output directory equal to the input parent directory.
   • Source and output aliases involving relative paths or symbolic links.
   • Existing destination files with matching basenames.
   • Explicit overwrite behavior when a future --force option is used.

6. Preserve the documented guarantee that original files are never modified, or revise the documentation if overwrite behavior is deliberately supported.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

Read the `.report.txt` file(s) generated alongside each converted template. For bulk conversions, also read `_summary.txt`.

**Note:** When flags are present, the script automatically:
- Prepends a `<!-- WARNING: ... -->` comment at the top of the converted file
- Wraps unsupported syntax in `<!-- FLAGGED [RULE]: message -->` HTML comments so the file can be pasted into the Mailtrap editor without triggering parser errors

### Step 3: Handle flags (Deep mode)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill instructs the agent to read and write files and execute a local Python script, but it does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization gap where an agent may use broader filesystem capabilities than intended, increasing the risk of unintended file access or writes if the input path or output directory is abused.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · content/how-to-migrate-email-templates.md (reported line 260)May include surrounding context.

Create a template:

bash

curl --request POST \
  --url "https://mailtrap.io/api/accounts/$MAILTRAP_ACCOUNT_ID/email_templates" \
  --header "Authorization: Bearer $MAILTRAP_API_TOKEN" \
  --header 'Content-Type: application/json' \