Security audit

FREE EMAIL from @claw.boston 一键获取免费原生OpenClaw邮箱

Security checks for vulnerabilities and agentic risk

Overview

This email skill is a coherent third-party mailbox integration, but it needs Review because it can read and send email, store a powerful API key, and process untrusted message content without enough safeguards.

Install only if you are comfortable using claw.boston as a third-party email provider for the messages and attachments you handle. Treat the local API key like a password, avoid sensitive or regulated email unless you understand the provider's retention and access policies, confirm setup and outgoing sends explicitly, and be cautious with messages that ask the agent to take actions or reveal information.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:121
Finding: Undisclosed Host-Derived Identifier Transmitted During Registration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:144
Finding: Untrusted Email and Webhook Content Lacks an Explicit Prompt-Injection Boundary
Content: View full analysis
2. Present the full email content naturally 3. If has_attachments is true, list the attachments with filenames and sizes ``` ```text ### Webhook notification (incoming email): 1. Parse the webhook payload 2. Notify user: "New email from {from} — Subject: {subject}" 3. Show preview 4. If has_attachments, mention: "This email has {attachment_count} attachment(s)" 5. Ask: "Want me to read the full email?" ``` The only documented prompt-injection-related safeguard appears at `SKILL.md:176`: ```text - Emails flagged as suspicious (potential prompt injection) will be noted ``` ### Technical Analysis Email bodies, subjects, sender fields, attachment names, and webhook previews are controlled by remote senders. The skill instructs the agent to parse and naturally present this content without explicitly requiring it to be treated solely as untrusted data. A malicious sender can place agent-directed instructions in an email, such as requests to reveal credentials, read local files, send messages, or invoke tools. When the content is inserted into the agent's context without a clear trust boundary, the model may interpret those instructions as actionable rather than as quoted mailbox content. The server-provided `is_suspicious` indicator is not an adequate security boundary. Detection can produce false negatives, and the documented behavior only says suspicious emails will be “noted”; it does not prohibit following instructions embedded in them. Safe processing must be enforced locally for every message, regardless of the service's classification. ### Attack Path 1. An attacker sends an email to the generated `@claw.boston` address. 2. The attacker places prompt-injection instructions in the ...[truncated 1294 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises sending, receiving, searching, and reading email through an external service, but it does not clearly warn users that mailbox contents, addresses, attachments, and metadata may be transmitted to or processed by a third party. Because email commonly contains sensitive personal and business information, missing privacy and data-handling disclosures can cause users to unknowingly expose confidential data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrase "I need an email address" is broad enough that it could plausibly appear in normal conversation, causing the skill to activate unexpectedly. In a skill that provisions mailbox access and may initiate external account setup, accidental invocation can lead to unintended disclosure of user data or unexpected external side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation states that the API key will be stored locally in a predictable file path, but it does not warn users that this credential grants access to their mailbox functions. If local file permissions are weak, the host is shared, or malware accesses the file, an attacker could send email, read inbox data, search messages, and download attachments through the API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly enables sending email bodies and attachments to a remote third-party service, but it does not present a clear user-facing privacy/security warning before encouraging use. Users may unknowingly transmit sensitive message contents, recipient data, and files off-device, creating confidentiality and compliance risk if the service is compromised, logs data, or handles it unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The webhook configuration pushes incoming email metadata to a local endpoint, but the skill does not clearly disclose this behavior to users. Even if only metadata and previews are sent, this can expose sender identities, subjects, and snippets to local listeners or logs and may create privacy issues on multi-user or instrumented systems.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.