clawmail.xyz - Give your openclaw an email address, no human required!

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:13 AM UTC
• Version: 1.0.0

Overview

The skill’s email functions are coherent, but it asks users and MCP clients to execute an unpinned npm package while also handling wallet authentication, session tokens, message reading, and message deletion.

Install only if you are comfortable trusting the current npm package and future package resolution for clawmail. Prefer a pinned, reviewed package version, run it with a low-privilege environment, avoid exposing unrelated wallet or credential data, and require explicit confirmation before deleting messages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-15, SKILL.md:103-113, and SKILL.md:116-128
Vulnerability Type: Unpinned and unverified third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

install:
  npm: clawmail

bash

npx clawmail

bash

npm install -g clawmail
clawmail

json

{
  "mcpServers": {
    "clawmail": {
      "command": "npx",
      "args": ["clawmail"]
    }
  }
}

Technical Analysis

The Skill directs users to install or execute the clawmail package without specifying an exact version, integrity hash, trusted artifact digest, or package provenance requirement. In particular, npx clawmail can resolve and download the package version currently exposed by the configured npm registry before executing it. The supplied MCP configuration repeats this behavior when the MCP server is launched.

Consequently, the code executed by users is not cryptographically bound to a version that was reviewed when this Skill was published. A compromised npm package, maintainer account, registry resolution path, or malicious future release could change the effective runtime payload without any modification to SKILL.md. The linked source repository does not, by itself, prove that an npm artifact was built from the referenced source.

The project contains only SKILL.md; therefore, the package implementation and its runtime behavior could not be examined as part of this audit. There is no evidence in the reviewed file that the current package release is malicious, but the unpinned execution mechanism creates a supply-chain exposure.

Attack Path

1. An attacker compromises the npm package, a package maintainer account, or the relevant package publication process.
2. The attacker publishes a malicious release under the existing clawmail package name.
3. A user follows the documented npx clawmail command, installs the p ...[truncated 1180 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact audited version in every installation and MCP configuration example, such as clawmail@X.Y.Z; do not use ranges or implicit latest-version resolution.
2. Record and verify the expected package integrity digest before execution. Where possible, distribute a lockfile or another reproducible dependency manifest containing integrity metadata.
3. Enable npm package provenance and verify that published artifacts originate from the expected repository and release workflow.
4. Review the package entry point, transitive dependencies, and lifecycle scripts for each approved release.
5. Disable lifecycle scripts during installation where operationally compatible, for example by using npm's --ignore-scripts option. This does not prevent malicious runtime code and must be combined with version and integrity verification.
6. Avoid repeatedly resolving the package through an unpinned npx command in MCP configuration. Install a verified version in a controlled location and configure the MCP client to invoke that fixed local executable.
7. Run the MCP server in a sandbox or dedicated low-privilege account with a restricted environment, minimal filesystem access, no unnecessary wallet or credential access, and narrowly scoped outbound network permissions.
8. Establish a controlled upgrade process in which new releases are reviewed and tested before the pinned version and integrity metadata are updated.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill metadata advertises execution via npx without pinning a specific package version, which allows whatever version is current on npm at runtime to be fetched and executed. This creates a software supply-chain risk: if the package is updated maliciously, compromised, or replaced with a bad release, agents may run unreviewed code automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documents a delete_message capability and shows how to invoke it, but provides no warning that the action is destructive or guidance for confirmation, preview, or recovery. In an agent-operated email context, this increases the risk of accidental or prompt-induced deletion of important messages, especially when tools may be called autonomously.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The usage instructions explicitly tell users to run npx clawmail, which pulls and executes the latest package version at execution time. In an agent/tooling context this is especially dangerous because it can convert a later upstream compromise into immediate arbitrary code execution on user or agent hosts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.