Pub Agentmail

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:18 PM UTC
• Version: 1.0.0

Overview

The skill is a broad external AI and messaging broker presented under an email-oriented name, with email/SMS sending and external data transfer that need clearer scoping and privacy guidance.

Review this as a broad third-party API skill, not just an email inbox tool. Install only if you intend to let the agent send content to SkillBoss/downstream providers and potentially send email or SMS; avoid regulated or secret data unless you have explicit approval, and prefer direct curl examples over any unverified run.mjs helper.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: audio-models.md:29
• Finding: Unbundled Executable Invoked Through the Host PATH<![CDATA[ ## Vulnerability Details **File Locations**: - `audio-models.md:29-32` - `chat-models.md:31-34` - `image-models.md:22-25` - `video-models.md:9-12` **Vulnerability Type**: Unverified external executable and PATH-based command resolution **Risk Level**: Medium ### Vulnerable Code `audio-models.md:29-32`: ```bash run.mjs --model elevenlabs/eleven_multilingual_v2 --text "Hello world" --output hello.mp3 run.mjs --model openai/whisper-1 --file recording.m4a run.mjs --model replicate/meta/musicgen --prompt "upbeat electronic" --duration 30 --output track.mp3 ``` `chat-models.md:31-34`: ```bash run.mjs --model bedrock/claude-4-5-sonnet --prompt "Explain quantum computing" run.mjs --model openai/gpt-4o-mini --prompt "Summarize this" --context "Be concise" ``` `image-models.md:22-25`: ```bash run.mjs --model mm/img --prompt "A sunset over mountains" --output sunset.png run.mjs --model vertex/gemini-3-pro-image-preview --prompt "A cat" --output cat.png ``` `video-models.md:9-12`: ```bash run.mjs --model mm/t2v --prompt "A cat playing" --output video.mp4 run.mjs --model mm/i2v --prompt "Zoom in slowly" --image "https://example.com/photo.jpg" --output video.mp4 ``` ### Technical Analysis The documentation instructs the agent to execute `run.mjs`, but the project does not contain that executable and provides no installation source, version, checksum, signature, or dependency lock file for it. Because it is invoked only by name, the shell must locate it through the host's `PATH`. This creates a supply-chain and command-resolution trust issue. The actual program executed depends on the environment in which the Skill runs rather than on reviewed project content. A malicious or unrelated executable named `run.mjs` placed earlier in `PATH` could therefore be selected. The Skill declares Bash access and requires `SKILLBOSS_API_KEY`. A substituted executable would run with the same operating-system identity and environment as the agent. The finding does not e ...[truncated 1500 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the reviewed helper in the project under a fixed project-relative path, such as `scripts/run.mjs`. 2. Invoke it explicitly through a trusted runtime and path: ```bash node ./scripts/run.mjs --model openai/whisper-1 --file recording.m4a ``` 3. Pin all helper dependencies with a lock file and exact versions. 4. Document the helper's authoritative source and verify releases with cryptographic hashes or signatures. 5. Avoid global installation instructions and bare executable names that rely on ambient `PATH` resolution. 6. Set a restricted `PATH` for automated execution and ensure its directories are not writable by untrusted users. 7. Prefer the direct, documented HTTPS API workflow in `SKILL.md` if a local helper is unnecessary. 8. Run the helper with the minimum required filesystem, environment, and network access. Pass required credentials narrowly rather than exposing the full parent environment. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:75
• Finding: Unvalidated Retrieval of a Server-Supplied URL<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:75-80` **Vulnerability Type**: Unrestricted URL retrieval and redirect following **Risk Level**: Low ### Vulnerable Code ```bash URL=$(curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \ | jq -r '.image_url // .result.image_url // .data[0]') curl -sL "$URL" -o sunset.png ``` ### Technical Analysis The API response is parsed for a URL and passed directly to `curl -L`. The workflow does not validate: - The returned URL scheme. - The destination hostname. - The resolved IP address. - Redirect destinations. - Whether the destination is loopback, private, or link-local. - The response content type. - The response size. - Whether parsing produced a valid URL. Because `-L` follows redirects, validating only the initial hostname would also be insufficient. If the API response or an allowed download host were compromised, the returned URL could direct the agent to an internal service or another attacker-selected resource reachable from the agent's network context. The response is written to `sunset.png` but is not executed by the documented command. This limits direct code-execution impact. Exploitation also depends on control of the API response, its infrastructure, or a redirect in the download chain. ### Attack Path 1. An attacker compromises or controls the API response path, a referenced content host, or a redirecting endpoint. 2. The response supplies an attacker-selected URL through `image_url`, `result.image_url`, or `data[0]`. 3. The command stores that value in `URL` without validation. 4. `curl -L` requests the URL and follows redirects from the agent's network context. 5. The request can reach an internal or otherwise restricted destination if that destination is accessible to the agent. 6. The resulting data is written ...[truncated 862 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require an `https` URL and reject all other schemes. 2. Permit downloads only from an explicit allowlist of trusted content-delivery hostnames. 3. Resolve the hostname and reject loopback, private, reserved, multicast, and link-local addresses. 4. Revalidate the scheme, hostname, and resolved address after every redirect, or disable redirects unless they are strictly necessary. 5. Apply connection, transfer, and total-time limits. 6. Enforce a maximum response size before and during download. 7. Verify the HTTP status code and expected image content type. 8. Validate the downloaded file using an image decoder rather than trusting its extension or response header. 9. Write to a securely created unique file and move it to the requested destination only after validation succeeds. 10. Fail closed when `jq` returns `null`, an empty value, malformed data, or more than one unexpected result. 11. Where supported, have the trusted API return a signed download URL restricted to a controlled HTTPS origin and short expiration period. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (36)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest markets the skill as an email inbox platform, but the body exposes a broad broker for chat, image, video, speech, search, document parsing, email, and SMS actions. This scope mismatch can mislead users and upstream policy systems, causing them to authorize a far more powerful capability set than expected, including outbound communications and sensitive data transfers.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation repeatedly instructs sending prompts, audio, documents, search queries, email content, and contact data to an external aggregation API and downstream providers, but gives no privacy, retention, or third-party sharing warning. Users may unknowingly disclose sensitive or regulated data to multiple external services through a single opaque endpoint.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## List Models

```bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Image Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Video Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Speech-to-Text

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.