Use a Mermail Agent Inbox

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.3

Overview

The skill is mostly well-scoped for verification email workflows, but its packaged MCP connection uses a broader Mermail endpoint than its own least-privilege design recommends.

Review before installing. The skill has strong written safety rules for OTPs, links, and mailbox reads, but the packaged MCP endpoint should ideally be changed to the dedicated agent-inbox profile or enforced with a host-side allowlist before use with sensitive verification emails.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: agents/openai.yaml:6
• Finding: Full-Catalog MCP Endpoint Violates Least-Privilege Requirements## Vulnerability Details **File Location**: `agents/openai.yaml:6-11` **Vulnerability Type**: Excessive MCP tool privileges **Risk Level**: Medium ### Vulnerable Code ```yaml dependencies: tools: - type: "mcp" value: "mermail" description: "Mermail workspace and mailbox MCP server" transport: "streamable_http" url: "https://console.mermail.app/mcp" ``` ### Technical Analysis The agent configuration connects to Mermail's unrestricted `/mcp` endpoint. According to `references/tools.md`, that endpoint exposes the full tool catalog, whereas the dedicated `/mcp?profile=agent-inbox` endpoint exposes only the 12 operations required for mailbox discovery, provisioning, and bounded email inspection. This configuration conflicts with the Skill's own least-privilege design. Although the instructions tell the model to self-restrict its tool usage, an instruction-level restriction is weaker than server-side tool exclusion. Tool-selection errors, prompt injection from untrusted email, or failures in host enforcement could therefore reach unrelated operations in the full Mermail catalog. ### Attack Path 1. The host loads the Skill and establishes the configured connection to `https://console.mermail.app/mcp`. 2. The unrestricted endpoint makes the full Mermail tool catalog available to the agent. 3. The agent processes attacker-controlled email metadata or content during the inbox workflow. 4. Prompt injection, model error, or inadequate host isolation influences tool selection. 5. The agent invokes an unrelated full-catalog operation that would not have been exposed by the dedicated `agent-inbox` profile. This path depends on a tool-selection or policy-enforcement failure; the project otherwise contains explicit instructions to treat inbound email as untrusted. ### Impact Assessment The agent could exercise Mermail capabilities beyond the legitimate requirements of creating or reusing a ...[truncated 488 chars]
• Remediation: ## Remediation Suggestions 1. Replace the full-catalog URL with the dedicated least-privilege profile: ```yaml dependencies: tools: - type: "mcp" value: "mermail" description: "Mermail workspace and mailbox MCP server" transport: "streamable_http" url: "https://console.mermail.app/mcp?profile=agent-inbox" ``` 2. Enforce a host-side allowlist containing only the 12 documented tools: - `get_api_credit_usage` - `list_workspaces` - `get_workspace` - `list_email_domains` - `list_workspace_mailboxes` - `list_mailboxes` - `create_mailbox` - `get_mailbox` - `list_emails` - `search_emails` - `get_email` - `get_email_context` 3. Do not rely exclusively on natural-language instructions to prevent access to unrelated tools. Apply the restriction at both the server profile and host authorization layers. 4. Add a configuration test that fails if the packaged agent endpoint is `/mcp` without the `profile=agent-inbox` query parameter. 5. Retain the existing safeguards for scan-gated reads, bounded content, prompt-injection handling, and fresh approval before using OTPs or magic links.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Workflow

1. Confirm the `mermail` MCP connection. Prefer `https://console.mermail.app/mcp?profile=agent-inbox` for a dedicated verification connection. Do not replace a shared full-catalog connection silently; self-restrict it to the exact read/provision tools in [tools.md](references/tools.md). Never ask the user to paste an API key into chat.
2. Resolve the credential-bound workspace with `list_workspaces({})`. Do not create or cross into another workspace. Pass its exact `workspaceId` only when the live MCP, CLI, or REST schema requires it; never invent one.
3. Call `list_mailboxes({})` before `create_mailbox`. Reuse only a mailbox whose exact address and recorded purpose match the same service and active flow. Reject a candidate with `disabled_at`, `can_receive: false`, `receiving_status` other than `ready`, another disabled state, the wrong workspace, missing `public_id` or email, or unusable inbound configuration. Treat `welcome_onboarding_status` set to `pending` as Mermail welcome/demo state, not by itself as failed delivery readiness. If multiple usable candidates remain, present non-secret metadata and ask the user to choose; never pick the newest automatically.
4. Provision only when discovery finds no suitable mailbox. Treat an explicit request to use or create a Mermail mailbox as authorization for one mailbox provision. Otherwise preview the collision-resistant service-scoped address and 10-credit cost first. Call `create_mailbox` once and include `settings.agentInbox: { "mode": "verification", "automationsEnabled": false }` when supported. On conflict, re-list once and reuse only an exact usable concurrent match; do not loop through writes.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

An earlier broad request such as “buy this for me” is context, not approval to accept a changed price, recurring charge, substitute item, new merchant, or different delivery destination.

Design reference: [Resend's Agent Email Inbox skill](https://github.com/resend/resend-skills/blob/main/skills/agent-email-inbox/SKILL.md) (MIT) for its untrusted-inbound-email and capability-scoping model, adapted here to Mermail's existing MCP and CLI contracts.

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.