ClawHub
Back to skill

Security audit

Mailtarget Email

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Mailtarget email administration, but it gives an agent broad email, account, and DNS-changing authority without enough scoping or confirmation guidance.

Install only if you intend to let an agent send email through Mailtarget and administer related infrastructure. Use narrowly scoped Mailtarget and Cloudflare credentials where possible, avoid broad production DNS tokens, require human review before sends, tracking, unsubscribe-bypass, deletes, API-key changes, sub-account changes, or DNS writes, and treat email content, attachments, recipient lists, and tracking data as sensitive third-party data sharing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

A documented DELETE /domain/sending/{id} capability is dangerous in an agent skill context because an LLM or calling workflow could supply an arbitrary domain ID and remove active sending infrastructure. Since this skill is designed to manage email infrastructure, exposing destructive ID-based operations without documented guardrails materially increases the chance of accidental or unauthorized tenant-impacting actions.

Content

Scanner excerpt · references/api.md (reported line 97)May include surrounding context.

md
`GET /domain/sending/{id}`

### Delete Domain
`DELETE /domain/sending/{id}`

### Get Unverified SPF
`GET /domain/sending/unverified-spf`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

DELETE /api-key/{id} enables revocation of credentials by identifier, which in an agent-operated environment can be abused or triggered mistakenly to disrupt integrations or force credential rotation outages. Because API key management is security-sensitive and impacts authentication boundaries, unsafe parameter handling or insufficient confirmation around this endpoint has severe operational and security consequences.

Content

Scanner excerpt · references/api.md (reported line 126)May include surrounding context.

md
`PUT /api-key/{id}`

### Delete Key
`DELETE /api-key/{id}`

## Sub Accounts

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

GET|PUT|DELETE /sub-account/{id} exposes direct object reference style control over sub-accounts, and the delete variant is especially risky if an agent can act on attacker-supplied or hallucinated IDs. In this skill's context, sub-accounts likely separate customers or operational units, so deletion could cause broad service disruption or cross-tenant impact if not tightly constrained.

Content

Scanner excerpt · references/api.md (reported line 137)May include surrounding context.

md
`POST /sub-account`

### Get / Update / Delete Sub Account
`GET|PUT|DELETE /sub-account/{id}`

## Permissions

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to send emails, attachments, and optionally enable open/click tracking through a third-party API without explicitly warning that recipient addresses, message bodies, attachments, and engagement telemetry will be transmitted to Mailtarget. This can cause unintended disclosure of sensitive or regulated data and privacy-impacting tracking if an operator or downstream agent uses the skill without informed consent or approval.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Simple send

bash
curl -X POST https://transmission.mailtarget.co/v1/layang/transmissions \
  -H "Authorization: Bearer $MAILTARGET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The autonomous domain setup section encourages end-to-end DNS modification with 'zero manual DNS editing' but does not warn that the skill will make external configuration changes affecting domain authentication and mail routing. In an agentic context, this increases the risk of unauthorized or accidental changes to production DNS, which can disrupt email delivery or alter security posture.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The document provides a Send Email endpoint with recipient addresses, message bodies, headers, attachments, metadata, and tracking options, but it does not warn that invoking it transmits potentially sensitive user data to an external service. For markdown files, behaviors affecting user data or privacy should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file describes multiple DELETE endpoints for domains, API keys, and sub-accounts, but it does not include any warning that these actions may be destructive or irreversible. Under the markdown-file criteria, descriptions that could affect user data or system integrity should disclose such risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation explicitly instructs users to provide Cloudflare DNS-write credentials and states the agent can autonomously modify live DNS, which expands the skill beyond a Mailtarget-only scope into infrastructure administration. This increases risk because an email-sending skill now facilitates privileged third-party DNS changes that could misconfigure mail security, disrupt domain services, or be abused if the agent behaves unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The autonomous DNS setup section instructs users to provide a write-scoped Cloudflare token and presents the process as effortless, but fails to warn that the agent will make immediate live DNS changes. This is dangerous because users may not appreciate that a documentation-driven action can alter production email authentication and tracking records, with possible service disruption or security side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide claims the agent can perform full autonomous domain setup and verification, exceeding the described Mailtarget-focused behavior and normalizing cross-system administrative actions. In context, this is dangerous because users may trust the skill for email only while unintentionally granting it authority to alter DNS infrastructure through another provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation encourages enabling open and click tracking without warning that these features collect recipient interaction data and may trigger privacy, consent, or regulatory issues. In an email automation skill, omission of those warnings increases the chance of unauthorized or non-compliant monitoring at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document instructs users to place a live Mailtarget API key into environment variables but does not explicitly warn that the key is sensitive credential material or advise safe handling practices. In an agent/integration context, this can lead to accidental exposure through logs, screenshots, shell history, shared environments, or over-broad runtime access, enabling unauthorized email sending and account abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide encourages bulk emailing, personalized campaigns, and open/click tracking without any caution about consent, lawful basis, recipient expectations, or privacy implications. In an email-sending skill, this omission is more dangerous because the capability directly enables outreach and behavioral tracking at scale, increasing risk of spam abuse, privacy violations, and regulatory noncompliance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document declares lang="en", which sets the content language to English with no indication that users can choose another language or that the skill is intentionally restricted to an English-speaking region. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.