IMAP Email Reader

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:32 AM UTC
• Version: 1.0.3

Overview

This IMAP email skill mostly does what it says, but it includes unsafe credential handling and a recurring email-summary example sent to a hard-coded phone number.

Review this skill carefully before installing. Replace the hard-coded iMessage phone number with your own confirmed destination or remove the cron example entirely, store IMAP credentials in a secure secret store or at least a chmod 600 ignored .env file, use TLS for remote IMAP servers, and do not disable certificate validation except for a verified local Bridge setup.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:143

Finding

Persistent Email Disclosure to a Hard-Coded iMessage Recipient

Content

View full analysis

Remediation

View remediation

`. - Require the user to explicitly provide and confirm the resolved destination before creating any scheduled task. - Display the schedule, mailbox scope, data included in notifications, and final recipient before registration. - Default to local output rather than external delivery. - Minimize notification contents, such as reporting only the unread-message count unless the user explicitly authorizes disclosure of subjects or bodies. - Document commands for listing, disabling, and deleting the scheduled task. - Consider requiring confirmation before enabling recurring access to sensitive mailbox content. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.sh:29

Finding

IMAP Credentials Written Without Restrictive File Permissions

Content

View full analysis

.env << EOF # IMAP Email Configuration # Generated: $(date) IMAP_HOST=127.0.0.1 IMAP_PORT=$PORT IMAP_USER=$EMAIL IMAP_PASS=$PASSWORD IMAP_TLS=false IMAP_MAILBOX=INBOX EOF ``` ### Technical Analysis The setup script writes the user's IMAP address and password to a plaintext `.env` file but does not establish a restrictive `umask` or explicitly set the file mode afterward. The resulting permissions therefore depend on the environment from which the script is executed. Under a permissive umask, the credential file may be readable by other users or processes on the same system. The password may be a reusable app-specific password or a ProtonMail Bridge credential that grants access to private mailbox data. ### Attack Path 1. The user runs `setup.sh` in an environment with a permissive file-creation mask. 2. The script creates `.env` and stores `IMAP_USER` and `IMAP_PASS` in plaintext. 3. The file receives group-readable or world-readable permissions. 4. Another local user, compromised process, backup utility, or overly broad service account reads the file. 5. The attacker uses the recovered credentials against the configured IMAP service or local ProtonMail Bridge. 6. The attacker reads mailbox content or changes message state within the permissions granted to the IMAP account. ### Impact Assessment Successful exploitation can expose reusable IMAP credentials and permit unauthorized access to private email. Depending on the account and provider, the attacker may read messages, enumerate folders, search correspondence, and modify read/unread flags. The issue does not itself provide operating-system privilege escalation, but it crosses the account-access boundary by exposing credentials to unintended local principals. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

False Assurance That the Credential File Is Already Ignored by Git

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/imap.js:15

Finding

Remote IMAP Connections Can Transmit Credentials Without Enforced TLS

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Known Vulnerable Dependency: linkify-it==5.0.0 — 2 advisory(ies): CVE-2026-48801 (LinkifyIt#match scan loop has quadratic algorithmic complexity); CVE-2026-59887 (linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on at)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile includes linkify-it 5.0.0, which is reported vulnerable to quadratic-time parsing behavior. In this skill, that package is pulled in via mailparser for processing email bodies, so a crafted email containing pathological link patterns could cause excessive CPU consumption and degrade availability. This is primarily a denial-of-service risk rather than direct code execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==7.0.11 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The lockfile includes nodemailer 7.0.11 with multiple advisories, including CRLF injection and content resolution issues. Although this skill is described as IMAP-focused rather than sending mail, mailparser depends on nodemailer internals, and vulnerable code may still be reachable depending on how message data is processed. The main likely impacts are denial of service or unsafe handling of crafted message content rather than guaranteed exploitation from this file alone.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: semver==5.3.0 — 1 advisory(ies): CVE-2022-25883 (semver vulnerable to Regular Expression Denial of Service)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

The lockfile includes semver 5.3.0, which is vulnerable to ReDoS. Here it is only a transitive dependency of utf7 used by imap, and package-lock evidence alone does not show attacker-controlled semver strings are parsed during normal email operations. This is a real vulnerable component, but in this skill context its exploitability appears limited.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/imap.js (reported line 10)May include surrounding context.

js

const imaps = require('imap-simple');
const { simpleParser } = require('mailparser');
require('dotenv').config({ path: __dirname + '/../.env' });

// Configuration from environment
const config = {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This finding corresponds to the code path that captures a sensitive IMAP password and immediately proceeds to persist it in a .env file. While prompting for a password is normal setup behavior, coupling it with plaintext local storage creates credential exposure risk if the file is read by other processes or accidentally shared.

Content

Scanner excerpt · setup.sh (reported line 29)May include surrounding context.

sh

read -s -p "IMAP Password (from Bridge): " PASSWORD
echo ""

# Create .env file
cat > .env << EOF
# IMAP Email Configuration
# Generated: $(date)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The here-document creates a .env file containing IMAP_USER and IMAP_PASS values, which stores mailbox credentials in plaintext. In the context of an email-management skill, exposed credentials can enable unauthorized reading and modification of email, making this more sensitive than a generic low-value secret.

Content

Scanner excerpt · setup.sh (reported line 30)May include surrounding context.

sh

echo ""

# Create .env file
cat > .env << EOF
# IMAP Email Configuration
# Generated: $(date)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The line itself is only a status message, but in context it confirms successful creation of the plaintext .env file that holds the IMAP credentials. The security issue is not the echo statement alone; it is part of the same credential-storage flow and reinforces that sensitive data has been persisted locally.

Content

Scanner excerpt · setup.sh (reported line 43)May include surrounding context.

sh

EOF

echo ""
echo "✅ Created .env file"
echo ""
echo "Testing connection..."
echo ""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 117)May include surrounding context.

json

"notes": [
        "Dependencies are managed via package.json",
        "Run 'npm install' in the skill directory to install required packages",
        "Create .env file with IMAP credentials before use"
      ]
    }
  },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 129)May include surrounding context.

json

"notes": [
        "Dependencies are managed via package.json",
        "Run 'npm install' in the skill directory to install required packages",
        "Create .env file with IMAP credentials before use"
      ]
    }
  },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 135)May include surrounding context.

json

"notes": [
        "Dependencies are managed via package.json",
        "Run 'npm install' in the skill directory to install required packages",
        "Create .env file with IMAP credentials before use"
      ]
    }
  },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 140)May include surrounding context.

json

"notes": [
        "Dependencies are managed via package.json",
        "Run 'npm install' in the skill directory to install required packages",
        "Create .env file with IMAP credentials before use"
      ]
    }
  },

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill exposes access to environment-stored IMAP credentials and email operations but does not declare an explicit tool scope such as allowed tools or permissions. In an agent environment, this can lead to overbroad execution and unclear trust boundaries, increasing the chance that the skill is invoked with unintended access to secrets or shell capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation recommends setting IMAP_REJECT_UNAUTHORIZED=false for self-signed certificates without clearly warning that this disables certificate validation and enables man-in-the-middle interception. Even if intended for ProtonMail Bridge on localhost, copying this guidance to other IMAP deployments could expose credentials and email content to network attackers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill handles highly sensitive email contents and explicitly documents cron delivery to external channels like iMessage, but it does not warn users that fetched or summarized messages may contain personal, financial, legal, or authentication data. Without a clear disclosure, users may unknowingly forward sensitive mailbox contents outside the email system, causing privacy breaches or data leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script reads IMAP credentials directly from environment variables, which is sensitive credential access in a code file. While the file has general comments about being an IMAP CLI, there is no confirmation prompt, user-facing disclosure, or explicit warning near the credential handling explaining that mailbox credentials will be consumed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markAsRead and markAsUnread functions modify message flags, which changes mailbox state, but they perform the action without any confirmation prompt or prior warning comment/documentation about altering message status. Although the command names imply the behavior, the file does not provide an explicit safety disclosure for these state-changing operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script collects an IMAP password and writes it directly into a local .env file in plaintext. This is dangerous because any local user, backup system, shell history exposure, accidental repository commit, or later file disclosure could expose credentials that grant access to the user's mailbox.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: mailparser==3.9.1 — 1 advisory(ies): CVE-2026-3455 (mailparser vulnerable to Cross-site Scripting)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The lockfile includes mailparser 3.9.1, which has an XSS advisory. In an IMAP email skill, parsing attacker-controlled email HTML is core functionality, so if parsed output is later rendered in a UI or webview without sanitization, malicious email content could execute script in the consuming context. The package-lock alone does not prove exploitability, but the dependency is real and the skill context makes it relevant.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a caret range (^5.1.0), which allows automatic installation of newer minor/patch releases rather than a single immutable version. This increases supply-chain risk and can introduce unexpected behavior or newly disclosed vulnerabilities during future installs, though by itself it is not an immediately exploitable flaw in this file.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"search": "node scripts/imap.js search"
  },
  "dependencies": {
    "imap-simple": "^5.1.0",
    "mailparser": "^3.7.1",
    "dotenv": "^16.4.7"
  },

Static analysis

No suspicious patterns detected.