Post

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:41 AM UTC
• Version: 1.5.0

Overview

This email-management skill is mostly coherent, but it documents risky credential handling, persistent background mail access, automatic hook execution, and an unsafe hook example that users should review before installing.

Install only if you are comfortable granting Post access to the selected mail accounts. Prefer interactive Keychain credential setup, narrow per-agent tokens, and one-off token injection over command-line passwords or workspace .env files. Do not enable the LaunchAgent or mail-arrival hooks unless you have reviewed the config, scripts, permissions, logging, and token scope; rewrite hook scripts to avoid shell execution and confirm message IDs before moving, trashing, archiving, or marking mail as junk.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Warning

• Location: SETUP.md:190

Finding

Persistent Mail Daemon Registered as a Login LaunchAgent

Content

View full analysis

~/Library/LaunchAgents/com.cocoanetics.postd.plist <<'EOF' Label com.cocoanetics.postd ProgramArguments /opt/homebrew/bin/postd start --foreground RunAtLoad KeepAlive StandardErrorPath /tmp/postd.log EOF launchctl load ~/Library/LaunchAgents/com.cocoanetics.postd.plist ``` The service is also reloaded during the documented restart procedure at `SETUP.md:241`. ### Technical Analysis The setup instructions create and load a macOS LaunchAgent with both `RunAtLoad` and `KeepAlive` enabled. Consequently, `postd` starts whenever the user logs in and is relaunched after termination. Persistent execution is reasonably related to the optional IMAP IDLE functionality declared by the Skill. However, it is not required for ordinary on-demand operations such as searching, fetching, drafting, or organizing email. Enabling it expands the security boundary from a single command invocation to continuous, cross-session access to configured mail accounts. The daemon can also invoke user-configured hook commands when messages arrive. A compromised daemon binary, configuration file, API token, or hook therefore gains a persistent execution opportunity. Writing logs to the predictable shared path `/tmp/postd.log` may additionally expose mail-related diagnostics or permit local log-path interference, depending on how the daemon opens the file. ### Attack Path 1. The user fol ...[truncated 1208 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SETUP.md:32

Finding

IMAP Password Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/hook-schema.md:145

Finding

Shell Command Injection in Python Mail Hook Example

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The documentation instructs users to write a mailbox access token into a .env file inside an agent workspace. Even with restrictive permissions, workspace files are commonly copied, indexed, backed up, committed, or read by other tooling, making this a meaningful credential exposure risk in an automation context.

Content

Scanner excerpt · SETUP.md (reported line 159)May include surrounding context.

In the agent’s working directory:

bash

echo 'POST_API_KEY=<token>' > .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This line is part of the same credential-storage pattern: securing a .env file with chmod 600 helps, but it still normalizes storing a live API token in a plaintext file within an agent workspace. The surrounding context makes the issue real because the skill is designed for agents that may surface workspace contents through logs, tools, or repository operations.

Content

Scanner excerpt · SETUP.md (reported line 160)May include surrounding context.

bash

echo 'POST_API_KEY=<token>' > .env
chmod 600 .env

Post will read POST_API_KEY from:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation includes an example passing the IMAP password directly on the command line. Command-line secrets may be exposed via shell history, process listings, terminal logging, or agent transcripts, which is especially risky for a skill intended to be used by automated agents and operators.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 54)May include surrounding context.

post credential delete --server work

text

## 3. Optional: create `~/.post.json`

For basic CLI use, credentials in the Keychain are enough.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup documentation explicitly recommends configuring a hook command that will execute automatically when new mail arrives, and later shows how to auto-start the daemon on login. In an agent/mail-processing context, this creates an easy path to unattended command execution triggered by untrusted external input (incoming email), increasing the risk of malicious email causing downstream script execution or abuse of fragile parsers/workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions recommend placing API tokens in environment variables and a local .env file without warning that agent workspaces, logs, child processes, debugging tools, and accidental commits can expose those tokens. In this skill’s context, the token grants mailbox access, so disclosure can directly enable unauthorized reading or actions across the allowed servers.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 160)May include surrounding context.

bash

echo 'POST_API_KEY=<token>' > .env
chmod 600 .env

Post will read POST_API_KEY from:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The documentation recommends creating a LaunchAgent plist to auto-start the mail daemon at login and restart it if it crashes. In a mail-processing skill, this establishes durable background execution and expands the blast radius of any unsafe daemon configuration, especially when combined with mail-triggered hooks or weakly protected tokens.

Content

Scanner excerpt · SETUP.md (reported line 197)May include surrounding context.

To have postd auto-start on login and restart if it crashes:

1. Create ~/Library/LaunchAgents/com.cocoanetics.postd.plist:

   bash

   cat > ~/Library/LaunchAgents/com.cocoanetics.postd.plist <<'EOF'
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This finding points into the LaunchAgent plist content that defines persistent startup behavior. The risk is not the XML itself, but that the file formalizes login persistence for a network-connected mail daemon, which can perpetuate insecure behavior or unauthorized access if the daemon or its config is compromised.

Content

Scanner excerpt · SETUP.md (reported line 200)May include surrounding context.

1. Create ~/Library/LaunchAgents/com.cocoanetics.postd.plist:

   bash

   cat > ~/Library/LaunchAgents/com.cocoanetics.postd.plist <<'EOF'
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate match refers to the same plist-based persistence mechanism. The concern is valid because persistent background startup increases the window of exposure for any misconfiguration, credential leakage, or unsafe mail-triggered automation in this skill.

Content

Scanner excerpt · SETUP.md (reported line 202)May include surrounding context.

bash

   cat > ~/Library/LaunchAgents/com.cocoanetics.postd.plist <<'EOF'
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate match refers to the same plist-based persistence mechanism. The concern is valid because persistent background startup increases the window of exposure for any misconfiguration, credential leakage, or unsafe mail-triggered automation in this skill.

Content

Scanner excerpt · SETUP.md (reported line 202)May include surrounding context.

bash

   cat > ~/Library/LaunchAgents/com.cocoanetics.postd.plist <<'EOF'
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This is another match within the LaunchAgent configuration establishing a persistent service label. The persistent daemon model is more dangerous in this skill than in a simple local utility because it continuously handles externally sourced email and may hold access tokens over time.

Content

Scanner excerpt · SETUP.md (reported line 203)May include surrounding context.

md

cat > ~/Library/LaunchAgents/com.cocoanetics.postd.plist <<'EOF'
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>Label</key>
       <string>com.cocoanetics.postd</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The closing portion of the plist remains part of the same persistence setup. The security concern is contextual: a continuously running mail daemon with auto-restart can sustain unauthorized or unsafe behavior beyond an interactive session.

Content

Scanner excerpt · SETUP.md (reported line 220)May include surrounding context.

StandardErrorPath /tmp/postd.log EOF

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This duplicate match again targets the LaunchAgent load step. The concern is valid because it transitions the daemon from on-demand use to persistent background execution, magnifying the impact of any other unsafe setup choice in the skill.

Content

Scanner excerpt · SETUP.md (reported line 227)May include surrounding context.

2. Load it:

   bash

   launchctl load ~/Library/LaunchAgents/com.cocoanetics.postd.plist
   

3. Verify:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This duplicate match again targets the LaunchAgent load step. The concern is valid because it transitions the daemon from on-demand use to persistent background execution, magnifying the impact of any other unsafe setup choice in the skill.

Content

Scanner excerpt · SETUP.md (reported line 227)May include surrounding context.

2. Load it:

   bash

   launchctl load ~/Library/LaunchAgents/com.cocoanetics.postd.plist
   

3. Verify:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The unload/load commands document lifecycle management of a persistent LaunchAgent. While administrative in nature, they reinforce and normalize persistent background execution for a mail daemon, which increases exposure duration and can preserve unsafe automation behavior.

Content

Scanner excerpt · SETUP.md (reported line 240)May include surrounding context.

To stop or restart:

bash

launchctl unload ~/Library/LaunchAgents/com.cocoanetics.postd.plist
launchctl load ~/Library/LaunchAgents/com.cocoanetics.postd.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This duplicate match is part of the same launchctl persistence flow. The issue is not inherently malicious, but it is a genuine security-relevant persistence mechanism whose risk is elevated by the skill’s support for automated email handling and optional command execution.

Content

Scanner excerpt · SETUP.md (reported line 241)May include surrounding context.

bash

launchctl unload ~/Library/LaunchAgents/com.cocoanetics.postd.plist
launchctl load ~/Library/LaunchAgents/com.cocoanetics.postd.plist

See Post Documentation/Daemon.md for full details.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This duplicate match is part of the same launchctl persistence flow. The issue is not inherently malicious, but it is a genuine security-relevant persistence mechanism whose risk is elevated by the skill’s support for automated email handling and optional command execution.

Content

Scanner excerpt · SETUP.md (reported line 241)May include surrounding context.

bash

launchctl unload ~/Library/LaunchAgents/com.cocoanetics.postd.plist
launchctl load ~/Library/LaunchAgents/com.cocoanetics.postd.plist

See Post Documentation/Daemon.md for full details.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly documents destructive mail operations like move, archive, trash, and junk without any cautionary guidance, confirmation pattern, or requirement to verify targets first. In an agent context, this increases the chance of accidental or overbroad mailbox modification or deletion, especially because UIDs are mailbox-scoped and mistakes could affect the wrong messages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples include destructive mailbox operations such as move, archive, trash, and junk without any adjacent warning that these actions change mailbox state and may be hard to undo. In an agent skill context, copy/paste recipes can be executed mechanically, so omission of cautions increases the chance of accidental data loss or misclassification of important email.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The token examples show passing API tokens on the command line and exporting them into the shell environment without warning about credential exposure. These patterns can leak secrets through shell history, process listings, logs, shared terminals, or inherited environments, which is especially risky in agent workflows handling mailbox access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes passing full email headers and markdown body content to arbitrary hook commands, but it does not warn that this exposes highly sensitive user data to any configured script. In this skill context, hooks are explicitly designed for automation and may be written by agents or users, so lack of privacy and trust-boundary guidance increases the risk of accidental exfiltration, overcollection, or unsafe downstream processing of email content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples and debugging guidance encourage printing email-derived fields and note that stdout/stderr is logged by the daemon, but they do not warn that subjects, senders, message bodies, or parsed content may end up in persistent logs. This is dangerous because email data often contains credentials, personal information, and internal business content, and debug or example logging patterns are frequently copied into production scripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The attachment examples write files directly to /tmp without warning that email attachments are untrusted content and that files are being persisted to disk. In a skill used by agents, this can lead to unsafe handling of sensitive or malicious attachments, accidental overwrites, or later processing of attacker-controlled files.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SETUP.md:117