Security audit

Agent Mailbox

Security checks across malware telemetry and agentic risk

Overview

This is a real local mailbox tool, but it needs Review because mailbox messages can drive automated task handling and outbound callbacks without enough safeguards.

Install only if you trust the agents or users that can write to the mailbox. Avoid enabling cron/heartbeat processing on untrusted mailboxes, remove or allowlist callback URLs before using the heartbeat example, validate agent names to prevent path surprises, and do not put secrets in messages. Treat cloud sync as data export and review exactly what will be sent before configuring a backend or API key.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The heartbeat processes mailbox messages and unconditionally performs a POST to a user-controlled callback_url found in message metadata. That enables attacker-influenced outbound network requests, which can be abused for SSRF, internal service probing, or data exfiltration via the result payload. In this mailbox-processing context, the capability is more dangerous because incoming messages are effectively untrusted input and the code presents the webhook behavior as a normal automation step.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide tells a user to run `npm publish` without warning that this will make the package publicly available and upload package contents and metadata to a third-party registry. In a skill context, users may follow the instructions mechanically and unintentionally expose private code, secrets accidentally included in the package, or organizational metadata.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The ClawHub publishing step instructs the user to create a public listing and share repository and package metadata externally, but it does not warn about the disclosure implications. This can lead to unintended exposure of project details, links, branding, and ecosystem presence, especially if the user assumes the action is only local or reversible.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README explicitly encourages unattended processing of urgent mail and shows example code that reads message metadata and executes a task automatically in a heartbeat/cron loop. In the context of an agent mailbox handling potentially untrusted messages, this normalizes message-driven autonomous execution without authentication, authorization, validation, or human approval, which can lead to arbitrary task triggering and dangerous agent behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly states that the heartbeat workflow will automatically 'execute callbacks' when processing urgent messages, but it provides no warning that this can trigger outbound network requests based on message content. In a mailbox system where messages may originate from other agents or handlers, this creates a risky trust boundary: an attacker could induce automatic requests to arbitrary callback URLs, enabling SSRF-like behavior, data exfiltration, or unintended interaction with attacker-controlled infrastructure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The cloud sync section says messages are 'local-only' by default, then immediately shows configuration commands for a cloud URL and API key without clearly warning that messages may leave the machine and secrets are being configured. This can mislead users into enabling remote sync without understanding the privacy and credential-handling implications, especially in a messaging system that may contain task details, agent coordination data, and sensitive metadata.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/agent-heartbeat.ts:17