ClawHub
Back to skill

Security audit

Sendook

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly scoped Sendook email helper that needs normal inbox credentials and network access to read and send mail.

Install this only for agents you trust to read and send mail from the configured inbox. Use a Sendook API key restricted to that inbox, review outbound messages and attachments before sending, and pin or lock the @sendook/node dependency where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Third-Party SDK Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31 Vulnerability Type: Supply-chain risk caused by an unpinned npm dependency Risk Level: Medium

Complete Code Snippet:

bash
npm install @sendook/node

Technical Analysis

The installation instructions do not specify an exact reviewed version of @sendook/node, require a lockfile, or verify package integrity. Consequently, the package resolved at installation time may differ from the version originally reviewed.

npm dependencies can execute lifecycle scripts during installation and arbitrary code when imported at runtime. Because the SDK operates in a process containing SENDOOK_API_KEY and SENDOOK_INBOX_ID, a compromised or unexpectedly modified package release could access these credentials. At runtime, it could also access email content and files deliberately loaded as attachments.

This is a supply-chain hardening deficiency rather than evidence that the named package is currently malicious.

Attack Path

  1. An attacker compromises the package publisher, registry distribution path, or a transitive dependency.
  2. The attacker publishes a malicious version that satisfies the unpinned installation request.
  3. A user follows the documented npm install @sendook/node command.
  4. npm resolves and installs the attacker-controlled release.
  5. Malicious code executes through an installation lifecycle script or when the SDK is imported.
  6. The code reads available Sendook credentials or email data and transmits them to infrastructure controlled by the attacker.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running npm or the agent process. Within the Skill's operational context, this may expose SENDOOK_API_KEY, SENDOOK_INBOX_ID, inbox messages and threads, outgoing email contents, and user-approved attachment data. The Sendook API key's server-side scope determines the maximum remote acco ...[truncated 94 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin @sendook/node to an exact version that has been reviewed rather than using an unconstrained package specifier.
  • Commit a lockfile and require reproducible installation with npm ci.
  • Verify package provenance and integrity through npm integrity metadata, trusted publishing information, and dependency review.
  • Audit direct and transitive dependencies before upgrades.
  • Disable npm lifecycle scripts during installation where compatible, enabling only scripts that have been explicitly reviewed.
  • Run the Skill in a sandbox with minimal filesystem and network access.
  • Continue using a least-privileged Sendook API key restricted to the designated inbox, and rotate the key if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash
# List all messages
curl https://api.sendook.com/v1/inboxes/$SENDOOK_INBOX_ID/messages \
  -H "Authorization: Bearer $SENDOOK_API_KEY"

# Search messages

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash
# List all messages
curl https://api.sendook.com/v1/inboxes/$SENDOOK_INBOX_ID/messages \
  -H "Authorization: Bearer $SENDOOK_API_KEY"

# Search messages

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash
# List all messages
curl https://api.sendook.com/v1/inboxes/$SENDOOK_INBOX_ID/messages \
  -H "Authorization: Bearer $SENDOOK_API_KEY"

# Search messages

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

bash
# List all messages
curl https://api.sendook.com/v1/inboxes/$SENDOOK_INBOX_ID/messages \
  -H "Authorization: Bearer $SENDOOK_API_KEY"

# Search messages

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

bash
# List all messages
curl https://api.sendook.com/v1/inboxes/$SENDOOK_INBOX_ID/messages \
  -H "Authorization: Bearer $SENDOOK_API_KEY"

# Search messages

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

bash
# List all messages
curl https://api.sendook.com/v1/inboxes/$SENDOOK_INBOX_ID/messages \
  -H "Authorization: Bearer $SENDOOK_API_KEY"

# Search messages

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

bash
# List all messages
curl https://api.sendook.com/v1/inboxes/$SENDOOK_INBOX_ID/messages \
  -H "Authorization: Bearer $SENDOOK_API_KEY"

# Search messages

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

bash
# List all messages
curl https://api.sendook.com/v1/inboxes/$SENDOOK_INBOX_ID/messages \
  -H "Authorization: Bearer $SENDOOK_API_KEY"

# Search messages

Static analysis

No suspicious patterns detected.