mailgun sender

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:49 AM UTC
• Version: 1.0.6

Overview

This Mailgun email skill mostly does what it says, but it has an unsafe credential-file fallback that can execute local shell code and its outbound email behavior needs clearer user control.

Review before installing. Use a narrowly scoped Mailgun sending key, confirm the resolved recipient and sender before use, avoid sending sensitive content unless intended, and do not rely on ~/.config/mailgun/credentials unless it is trusted, user-owned, non-symlinked, and locked down. Prefer environment variables or a non-executable config format over sourcing a credential file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_email.sh:7
• Finding: Credential File Is Executed as Arbitrary Shell Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send_email.sh`, lines 7–9 **Vulnerability Type**: Unsafe execution of a credential configuration file **Risk Level**: Medium ```bash if [ -z "$MAILGUN_API_KEY" ] && [ -f ~/.config/mailgun/credentials ]; then source ~/.config/mailgun/credentials fi ``` ### Technical Analysis The `source` command executes the entire contents of `~/.config/mailgun/credentials` in the current shell. It does not restrict the file to variable assignments, so any shell command placed in the credential file will run with the permissions of the user invoking the Skill. The script only checks that the path exists as a file. It does not verify: - That the file is owned by the invoking user. - That its permissions prevent modification by other users. - That the path is not a symbolic link. - That the contents contain only approved Mailgun configuration keys. - That the configuration syntax is non-executable. Executing a configuration file exceeds the minimum privileges necessary to retrieve `MAILGUN_API_KEY` and `MAILGUN_DOMAIN`. It is also inconsistent with `SKILL.md`, which primarily documents environment-variable configuration rather than executable credential files. This does not establish that the bundled project is intentionally malicious. Exploitation requires an attacker or compromised process to gain write or redirection influence over the credential path. ### Attack Path 1. An attacker gains the ability to create, replace, modify, or redirect `~/.config/mailgun/credentials`. 2. The attacker inserts arbitrary shell commands into the file, for example commands that copy accessible data or modify user files. 3. The user invokes `scripts/send_email.sh` while `MAILGUN_API_KEY` is unset. 4. The file existence test succeeds. 5. `source ~/.config/mailgun/credentials` executes the attacker-controlled commands in the current shell. 6. The commands run with the invoking user's privileges and access to that user's en ...[truncated 516 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Remove the executable credential-file fallback and require the documented environment variables. If file-based configuration is necessary: 1. Use a non-executable configuration format, such as JSON, and parse it with a parser that never evaluates shell syntax. 2. Allow only explicitly supported keys, such as `MAILGUN_API_KEY`, `MAILGUN_DOMAIN`, `MAILGUN_FROM`, and `MAILGUN_DEFAULT_TO`. 3. Reject symbolic links and non-regular files. 4. Verify that the file is owned by the invoking user. 5. Require restrictive permissions, such as mode `0600`. 6. Store the file under a fixed, user-controlled directory with restrictive permissions. 7. Never use `source`, `.`, `eval`, or command substitution to parse credential data. 8. Update `SKILL.md` so its documented configuration mechanism exactly matches the implementation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/send_email.sh:28
• Finding: Mailgun API Key Is Exposed in the Curl Process Argument Vector<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send_email.sh`, lines 28–30 **Vulnerability Type**: Secret exposure through command-line arguments **Risk Level**: Low ```bash RESPONSE=$(curl -s -w "\n%{http_code}" --user "api:$MAILGUN_API_KEY" \ "https://api.mailgun.net/v3/$MAILGUN_DOMAIN/messages" \ -F from="$FROM" \ ``` ### Technical Analysis The shell expands `MAILGUN_API_KEY` before starting `curl`. Consequently, the authentication value supplied through `--user "api:$MAILGUN_API_KEY"` becomes part of the `curl` process argument vector. Depending on the operating system and process-inspection controls, command-line arguments may be visible through process-listing tools or process metadata. A local process with sufficient visibility could inspect the `curl` invocation while the request is active and recover the Mailgun API key. The request is sent to a fixed HTTPS Mailgun hostname, so the reviewed code does not transmit the key to an unrelated remote service. The vulnerability concerns local process exposure rather than plaintext network transmission. ### Attack Path 1. A user invokes `scripts/send_email.sh` with a valid Mailgun API key. 2. The script starts `curl` with the API key embedded in its `--user` argument. 3. While `curl` is running, a local attacker or monitoring process with permission to inspect the user's processes reads its command-line arguments. 4. The attacker extracts the Mailgun API key. 5. The attacker reuses the key against the Mailgun API, subject to the permissions and restrictions assigned to that key. ### Impact Assessment A recovered API key may permit unauthorized use of the associated Mailgun account or domain, particularly unauthorized email submission. Potential consequences include spam delivery, impersonation of configured senders, consumption of account quotas, financial costs, and reputational or deliverability damage. The exact scope depends on the privileges assigned to the Mailgun key. Ex ...[truncated 105 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Avoid placing the API key directly in the process argument vector. Recommended hardening measures include: 1. Supply curl authentication through a protected input mechanism that does not contain the secret in command-line arguments, such as a curl configuration delivered through standard input. 2. If temporary credential storage is unavoidable, create it with mode `0600`, prevent symlink attacks, and remove it reliably with a shell `trap`. 3. Do not print the API key in diagnostic output, command traces, or error messages. 4. Disable shell tracing around secret-handling code if callers might enable `set -x`. 5. Use a restricted Mailgun sending key where supported, rather than a broadly privileged account key. 6. Rotate the key if process monitoring or logs may already have captured command arguments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation indicates shell-based execution via local scripts, but it does not declare any explicit tool scope such as allowed shell access. That weakens security boundaries and reviewability, because an agent may invoke shell capabilities more broadly than expected when handling email-sending tasks.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill supports default recipients and custom recipient/sender overrides, but it does not warn that these settings can send potentially sensitive content to external addresses without sufficient user awareness. In an agent context, silent use of MAILGUN_DEFAULT_TO or caller-provided addresses increases the risk of unintended data exfiltration through outbound email.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs a network transmission to a third-party email service, including the message body, subject, sender, and recipient, but provides no prior user-facing warning or confirmation before sending. Although the script reports success or failure afterward, that is not a disclosure before the safety-relevant operation occurs.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Send email via Mailgun API
RESPONSE=$(curl -s -w "\n%{http_code}" --user "api:$MAILGUN_API_KEY" \
    "https://api.mailgun.net/v3/$MAILGUN_DOMAIN/messages" \
    -F from="$FROM" \
    -F to="$TO" \
    -F subject="$SUBJECT" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Send email via Mailgun API
RESPONSE=$(curl -s -w "\n%{http_code}" --user "api:$MAILGUN_API_KEY" \
    "https://api.mailgun.net/v3/$MAILGUN_DOMAIN/messages" \
    -F from="$FROM" \
    -F to="$TO" \
    -F subject="$SUBJECT" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This markdown file documents an operation that transmits user-provided content, recipient addresses, and optional attachments to an external email service. Under the markdown-specific warning criterion, the description omits any user-facing caution about sharing sensitive data, attachments, or recipient information with a third-party provider.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file includes user-facing natural-language content in Chinese, which imposes a specific language on users without any opt-in or alternative. This can violate language/locale policy where skills should not force a language unless clearly justified or optional.

Static analysis

No suspicious patterns detected.