ClawHub
Back to skill

Security audit

STM Assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill openly supports sending emails for the user, but it gives the agent broad authority to send routine messages without prior approval.

Install only if you are comfortable giving an agent authority to send some routine emails from a configured inbox. Before use, require explicit approval for all outbound messages or define a very narrow pre-approved workflow with allowed recipients, templates, rate limits, and logging.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README explicitly promotes autonomous outbound emailing on behalf of a human and says the human 'never touches the send button,' but it does not establish a clear default requirement for consent, approval boundaries, or recipient safeguards. In an email-outreach skill, this creates a real risk of unauthorized communications, impersonation concerns, privacy leakage through CC/reply routing, and policy-violating spam or sensitive outreach.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- **Use full legal name** on formal correspondence
- **Monitor for replies** — set up a heartbeat check on the inbox
- **Mark processed emails** — remove "unread" label after handling
- **Never send without approval** for high-stakes emails (legal, financial, employment)

## Requirements
Confidence
81% confidence
Finding
The line 'Never send without approval for high-stakes emails' implies that lower-stakes emails may be sent without approval, which is still autonomous decision-making affecting external parties. In this context, the skill is specifically designed to send professional emails on someone else's behalf, so allowing any unapproved outbound communication increases the chance of reputational harm, unauthorized commitments, spam, or disclosure of sensitive information.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill is user-invocable and broadly described as sending professional outreach on behalf of the user, but it does not narrowly constrain permissible triggers, recipients, or business context. In an agent environment, this can cause overbroad activation and unintended email drafting or sending, increasing the risk of unauthorized contact, privacy leakage, or reputational harm.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly authorizes outbound email sending, CCs a human, sets Reply-To, and modifies inbox state, yet it lacks a prominent user-facing warning that it can perform external communications and alter message status. Because these are real-world side effects involving third-party recipients and message metadata, an agent could act without the user fully understanding the privacy, compliance, and operational consequences.

Static analysis

No suspicious patterns detected.