Security audit

Agent Mailbox

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local agent mailbox, but it has under-scoped filesystem writes and optional automation that can trigger untrusted tasks or web callbacks.

Review this skill before installing in any shared or sensitive environment. Use only trusted agent identifiers, avoid running the heartbeat example on untrusted mail, do not enable callbacks or cloud sync without allowlists and authentication, and treat mailbox files and exports as plaintext sensitive data. Prefer archive over delete unless permanent removal is intended.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/lib/mailbox.ts:64
Finding: Mailbox Path Traversal Through Unvalidated Agent Identifiers
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: examples/agent-heartbeat.ts:28
Finding: Unauthenticated Task Processing With Arbitrary Webhook Requests
Content: View full analysis
): Promise { console.log(`[WEBHOOK] Calling ${url}`); try { const response = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload), }); ``` ### Technical Analysis The supplied heartbeat example is intended to run periodically through cron. It treats any urgent message containing `metadata.task_id` as an executable task and passes the message to `executeTask()` without authenticating the sender, verifying a signature, checking task authorization, or requiring operator approval. After execution, the code passes the message-controlled `metadata.callback_url` directly to `fetch()`. It does not constrain the protocol or destination and does not block loopback, private, link-local, or cloud metadata addresses. Consequently, an attacker who can place or send a qualifying mailbox message can cause the ag ...[truncated 1924 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/lib/mailbox.ts:389
Finding: Sender Spoofing and Frontmatter Injection in Message Files
Content: View full analysis
0 ? `metadata: ${JSON.stringify(msg.metadata)}` : ''} --- ${msg.body} ${ msg.responses.length > 0 ? `\n## Responses\n\n${msg.responses.map((r) => `**${r.from}** (${r.created_at}):\n${r.body}`).join('\n\n---\n\n')}` : '' }`; return yaml; } ``` ```typescript const lines = frontmatter.trim().split('\n'); const meta: Record = {}; for (const line of lines) { const [key, ...valueParts] = line.split(': '); const value = valueParts.join(': ').trim(); if (key === 'metadata') { meta.metadata = JSON.parse(value); } else { meta[key] = value; } } ``` ### Technical Analysis The CLI derives the claimed sender identity directly from `AGENT_NAME` or `USER`, neither of which constitutes authenticated identity. A local caller capable of setting the environment can therefore claim another agent's name. Message fields are then interpolated into a hand-built, line-oriented frontmatter format without escaping or rejecting newline and control characters. A field containing a newline can introduce additional frontmatter lines. The parser processes every line as a key-value pair and overwrites previously stored values when a duplicate key appears ...[truncated 1654 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/lib/mailbox.ts:468
Finding: Ambiguous Substring Matching Selects Incorrect Messages
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This guide includes direct npm publish and clawhub publish commands plus promotional follow-up steps without an explicit warning that they will perform irreversible public release to external services. In an agent-skill context, users may treat documentation as operational instructions and accidentally publish unfinished, sensitive, or internal code, which can expose source, metadata, or package names publicly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README emphasizes local storage and manual sync options, but it does not clearly warn that messages are stored as plaintext Markdown/YAML files and that syncing the mailbox directory via Git, rsync, or backups can disclose sensitive message contents and metadata. In this skill's context, mailbox messages may contain task details, coordination data, and potentially operationally sensitive information, so understated documentation can cause users to deploy it with incorrect security assumptions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation states messages stay local by default, but it also describes automatic execution of callbacks derived from message metadata. That means untrusted message content can trigger outbound network activity, contradicting the privacy model and increasing the risk of SSRF-like behavior, data exfiltration, or unintended contact with attacker-controlled endpoints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The heartbeat feature says it will automatically process urgent messages and execute callbacks, but it does not clearly warn users that this can cause outbound network activity and side effects without review. In an agent mailbox context, messages are inherently untrusted inputs, so auto-executing callback behavior materially increases the risk of abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The cloud sync section provides commands to set a cloud URL and API key, but it does not clearly warn that messages and credentials will be transmitted to an external backend. This omission can lead users to expose private message contents and secrets to third-party infrastructure without fully understanding the security implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The process-urgent command performs mailbox state changes by marking urgent messages as read and archiving expired messages during processing. While it logs that urgent messages are being processed, it does not clearly disclose beforehand that invoking this command will modify message status and archive messages automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The export command writes the entire mailbox, potentially including sensitive message contents and metadata, to an unencrypted JSON file in the current working directory without any warning, access control check, or safer destination handling. In multi-user or shared-agent environments, this can lead to inadvertent data exposure through permissive filesystem locations, backups, logs, or accidental commits.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The delete method irreversibly removes a message file with fs.unlinkSync, but the only disclosure is an internal log entry after deletion. There is no confirmation prompt, user-facing notice, or explicit warning comment/docstring indicating that this operation permanently deletes stored user data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The archiveExpired method automatically rewrites message files into the archive and deletes the originals via fs.unlinkSync, affecting stored user data without any user-facing disclosure. Internal logging exists, but it does not satisfy the requirement for a visible warning or documented explanation of this safety-impacting behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The security section claims no credentials are transmitted with messages, yet the documented message metadata supports arbitrary fields including callback URLs that can drive external requests. Even if credentials are not embedded in the message body itself, this design can still cause authenticated or sensitive workflow data to be sent externally, making the claim misleading and weakening operator trust.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The commands table includes a delete operation, but the markdown does not indicate whether deletion is permanent, reversible, or how it differs from archiving. For an operation that can remove user data, the skill description should include a brief warning to prevent accidental loss.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This is a manifest file, so vague-trigger review applies. The description states the skill is an 'Email system for the agent economy' that can 'Send and receive messages between agents, handlers, and users,' but it does not define when the skill should be invoked, what requests should trigger it, or any exclusions, which can contribute to overly broad matching in systems that use manifest text for routing.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 27)May include surrounding context.
json
"license": "MIT", "dependencies": {}, "devDependencies": { "@types/node": "^20.0.0", "typescript": "^5.0.0" }, "repository": {

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 28)May include surrounding context.
json
"dependencies": {}, "devDependencies": { "@types/node": "^20.0.0", "typescript": "^5.0.0" }, "repository": { "type": "git",

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The docstring for this handler says only 'read - Read a specific message', which implies a retrieval operation. In addition to displaying the message, the function changes state at L150-L153 by calling markRead on unread messages, so the inline documentation understates and contradicts the behavior's side effects.
Content: No source excerpt is available for this finding.