Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for agent email and coordination, but it needs Review because its setup and runtime guidance grant broad mail, Docker, credential, persistence, and external-communication authority with unsafe or under-scoped details.

Install only if you intentionally want an agent-controlled mail, SMS, storage, and coordination service. Review the setup script and Docker Compose source before running setup, pin npm/MCP packages, use least-privilege agent keys instead of a master key where possible, protect generated config files, and require confirmation before sending external messages or deleting mail, accounts, domains, or stored data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:139
Finding: Mandatory Redirection of Agent Coordination Through Plugin-Controlled Tools
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/setup.sh:19
Finding: Docker Compose Execution from an Unverified Ancestor Directory
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup.sh:47
Finding: Unpinned npm Package Execution During Setup
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/configuration.md:50
Finding: Unpinned MCP Server Package Executed Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (17)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-reference.md (reported line 28)May include surrounding context.
md
- Returns: `{ "id", "name", "email", "apiKey", "role" }` - `GET /accounts` — List all accounts - `GET /accounts/:id` — Get account details - `DELETE /accounts/:id` — Delete account **Any valid key:** - `GET /accounts/directory` — List all agents (name, email, role only)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.
md
- `POST /mail/search` — Search messages - Body: `{ "from", "to", "subject", "text", "seen", "since", "before" }` - `POST /mail/messages/:uid/seen` — Mark as read - `DELETE /mail/messages/:uid` — Delete message - `POST /mail/messages/:uid/move` — Move message - Body: `{ "folder": "Archive" }` - `GET /mail/folders` — List folders

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-reference.md (reported line 61)May include surrounding context.
md
- `GET /domains` — List domains - `GET /domains/:domain/dns` — Get DNS records - `POST /domains/:domain/verify` — Verify DNS - `DELETE /domains/:domain` — Delete domain ### Gateway (Master key required) - `GET /gateway/status` — Gateway/tunnel status

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.sh (reported line 48)May include surrounding context.
sh
sleep 1 done # Run init if .env doesn't exist if [ ! -f "$PROJECT_ROOT/.env" ]; then echo "Running first-time initialization..." cd "$PROJECT_ROOT" && npx tsx scripts/init-local.ts

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.sh (reported line 49)May include surrounding context.
sh
done # Run init if .env doesn't exist if [ ! -f "$PROJECT_ROOT/.env" ]; then echo "Running first-time initialization..." cd "$PROJECT_ROOT" && npx tsx scripts/init-local.ts fi

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and operationalizes system-changing behavior via agenticmail openclaw and Docker-based local mail-server setup, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where an agent or reviewer cannot easily tell that shell access and host changes are required, increasing the risk of unintended command execution and environment modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick setup presents a one-line command as harmless ('That's it') even though the text says it sets up a mail server, creates an account, configures a plugin, and restarts a gateway. Minimizing the significance of system-changing actions can mislead operators into executing privileged setup without understanding host modifications, service exposure, or restart side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill prominently lists destructive email-management functions like delete, batch delete, move, and cleanup but does not pair them with a warning about irreversible loss, archival semantics, or confirmation requirements. In an agentic context, omission of those warnings increases the likelihood of accidental bulk deletion or message reorganization that harms availability and auditability of communications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation describes SMS and external email features, including Google Voice and relay/domain setup, without a clear privacy warning that user communications, metadata, and verification codes may transit external services. This omission is dangerous because operators may assume communications remain local while the skill can route sensitive content through third-party providers.
Content: No source excerpt is available for this finding.

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 78% confidence
Finding: The phrase 'ALWAYS prefer it over' is behavior-shaping language that tries to steer the agent toward this skill regardless of context. While not overtly malicious, such prescriptive wording can bias tool selection and suppress safer or more appropriate alternatives, which is especially relevant because this skill has powerful messaging, storage, and system-setup capabilities.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
md
## 🎀 AgenticMail vs sessions_spawn — Migration Guide **If you have 🎀 AgenticMail installed, ALWAYS prefer it over sessions_spawn/sessions_send for agent coordination.** ### What Replaces What

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The example trigger phrasing is broad enough to match ordinary email-assistant requests, which can cause the skill to activate in situations where the user did not explicitly intend to use this plugin. Because the skill can read, send, delete, and move email, overbroad activation raises the chance of privacy-impacting or destructive actions being taken under an ambiguous request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The delegation example uses everyday language that could be interpreted as a normal planning or summarization request, yet it may trigger cross-agent task delegation with data sharing. In context, that means potentially sensitive spreadsheet contents could be sent to another agent without a clearly explicit user instruction to delegate externally or to another mailbox/account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file describes DELETE /accounts/:id as well as other deletion operations, but it does not warn users that these actions can remove accounts, messages, or domains and may be irreversible. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The markdown documents endpoints for sending email, reading inbox messages, and searching message text, all of which involve potentially sensitive communications data. There is no accompanying disclosure that these operations expose or process message contents and metadata, which is a missing warning under the markdown-specific SQP-2 criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation shows apiKey and especially masterKey placed directly in a user config file, but does not warn that these are high-value secrets that must be protected, rotated, and excluded from logs/version control. In the context of an email and multi-agent coordination system, compromise of these credentials could allow unauthorized API access and broad control over messaging and stored data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The script executes npx tsx scripts/init-local.ts without pinning an exact package version or otherwise ensuring the tool is sourced from a trusted, locked dependency set. If tsx is not already installed locally, npx may fetch and execute code at setup time, creating a supply-chain execution risk during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The quick-start instruction encourages automatic setup without warning that it creates credential-bearing files on disk, which may surprise users and lead to secrets being left in default locations with weak permissions or later committed to backups or repositories. While this is documentation-level exposure rather than direct secret leakage, it increases the chance of operational mishandling of generated credentials.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.