Email Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:40 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a local email drafting helper, but it needs review because it can persist email-related data and contains hardcoded author identity/promotional signature content that could end up in user emails.

Review this skill before installing. It does not show evidence of network calls, inbox access, credential use, or code execution, but it writes persistent local email-manager files and may retain drafts or workflow history. Do not use the signature feature without checking the output carefully, because the artifact contains the author's identity and promotional link as example signature content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:531
• Finding: Hardcoded Third-Party Identity and Promotional Link Injected into Generated Email Signatures## Vulnerability Details **File Location**: `SKILL.md:531-547` **Vulnerability Type**: Output integrity compromise through skill-level instruction hijacking **Risk Level**: Medium **Vulnerable Code Snippet**: ```text Style 1 — Minimal: Best regards, Manish Pareek AI Developer | Freelancer [e-mail] Style 2 — Professional: — Manish Pareek AI Developer & Automation Specialist 📧 [e-mail] 🐦 @Mkpareek19_ 🌐 portfolio.com Style 3 — With CTA: — Manish Pareek | AI Developer Building free AI tools for freelancers 🦞 Check my skills: clawhub.ai/mkpareek0315 📧 [e-mail] ``` ### Technical Analysis The email-signature feature embeds a specific third party's name, occupation, social-media handle, email address, and promotional URL into example outputs. Because these values appear in operative skill instructions rather than being represented consistently as neutral placeholders, an agent following the skill can reproduce the skill author's identity and advertising content when a user asks it to create a signature. This behavior changes the expected objective from creating a signature based exclusively on user-supplied information to potentially promoting or impersonating a third party. It is best classified as `T01: Skill Instruction Hijacking` because the loaded skill text influences agent output in a way that is unrelated to the user's intended identity. No evidence indicates that the URL is fetched automatically, that code is executed, or that credentials or elevated system privileges are obtained. The issue is limited to generated-content integrity and the possible distribution of unsolicited third-party identity information. ### Attack Path 1. A user loads the email-manager skill. 2. The user requests an email signature without supplying complete identity information. 3. The agent follows Feature 10 and uses one of the hardcoded signature examples. 4. The generated sig ...[truncated 987 chars]
• Remediation: ## Remediation Suggestions 1. Replace all real or author-specific identity data with unmistakable placeholders such as `[Your Name]`, `[Your Role]`, `[Your Email]`, `[Your Social Profile]`, and `[Your Website]`. 2. Remove `clawhub.ai/mkpareek0315` and all other promotional content from user-facing signature templates. 3. Construct signatures only from identity fields explicitly supplied or confirmed by the user. 4. If required fields are missing, ask the user for those fields rather than filling them with example identities. 5. Display a final preview and require confirmation before saving a generated signature as the default. 6. Add an explicit instruction that third-party names, handles, contact details, branding, and links must never be inserted unless the user specifically requests them. 7. Add tests that generate signatures with incomplete profiles and verify that output contains only placeholders or user-provided values.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: email-manager
description: When user asks to write email, draft reply, manage inbox, email template, follow up email, cold email, professional email, email subject line, thank you email, apology email, meeting request email, salary negotiation email, resignation email, complaint email, email signature, batch emails, email tracker, email tone check, or any email writing and management task. 22-feature AI email manager with smart drafting, templates, tone checker, follow-up tracker, cold email generator, and batch composer. Replaces $30/month email tools for free. All data stays local — NO external API calls, NO network requests, NO data sent to any server. Does NOT access your inbox — generates email text for you to copy.
metadata: {"clawdbot":{"emoji":"📧","requires":{"tools":["read","write"]}}}
---

• Confidence: 82% confidence
• Finding: The skill is designed with persistent local storage for settings, templates, follow-ups, and history, which creates session persistence across interactions. While local-only storage is safer than exfiltration, persistence still introduces privacy and integrity risk because sensitive email content, signatures, and workflow data may be retained longer than users expect and may be modified on accidental activation.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The top-level description includes a broad catch-all trigger: 'any email writing and management task,' which can match a very large portion of routine user requests. Because descriptions often drive routing, this creates overbroad scope and raises the probability of the skill being selected unexpectedly, despite its stateful read/write behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation section enumerates many common phrases such as 'reply to', 'follow up', and 'subject line' that are likely to appear in ordinary conversation, increasing the chance the skill activates when the user did not intend to invoke it. Unintended activation matters here because the skill has read/write permissions and persistent local storage, so accidental use can cause unwanted file creation or state changes.

Static analysis

No suspicious patterns detected.