email-cron-handler

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:04 AM UTC
• Version: 1.0.0

Overview

This skill openly builds an email-driven agent automation loop, but it gives incoming email too much unattended control and can email sensitive results back out.

Install only if you deliberately want a mailbox to trigger unattended agent work. Use a dedicated mailbox and app password, do not place secrets in prompts or cron payloads, fail closed unless a verified sender is configured, restrict commands to a small allowlist, require approval for file access or side effects, and avoid emailing raw outputs or detailed errors.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: references/01-config-template.md:18
• Finding: Untrusted Email Content Is Executed as Agent Instructions## Vulnerability Details **File Location**: `references/01-config-template.md:18-39`, `references/01-config-template.md:46-61`, `SKILL.md:52-58` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical ### Vulnerable Code Snippet `references/01-config-template.md:18-39`: ```text 请用Python imaplib和smtplib检查邮箱 {EMAIL} 的最近50封邮件（包括已读和未读）。 IMAP登录: user={EMAIL}, password={PASSWORD}, host={IMAP_HOST}, port={IMAP_PORT} SMTP登录: user={EMAIL}, password={PASSWORD}, host={SMTP_HOST}, port={SMTP_PORT} ⚠️ 核心任务：读取 {WHITELIST_SENDER} 发来的邮件，邮件内容是你需要执行的指令！ 处理步骤： 1. 读取~/.openclaw/workspace/memory/processed_emails.json，获取已处理邮件UID列表 2. 获取最近50封邮件 3. 筛选出发件人 {WHITELIST_SENDER} 的未处理邮件 4. 对每封未处理邮件： a. 解析邮件内容，这就是你需要执行的指令 b. 尝试执行该指令（查询天气/搜索信息/执行操作等） c. 将执行结果（或失败信息）作为邮件正文，用SMTP回复给发件人 - 执行成功：正文写实际执行结果 - 执行失败：详细说明失败原因 d. 将该邮件UID添加到已处理列表 5. 保存更新后的已处理列表到~/.openclaw/workspace/memory/processed_emails.json 【重要】无论成功还是失败，都必须回复邮件！ 执行完成后汇报处理结果。禁止使用浏览器工具。 ``` `references/01-config-template.md:46-51`: ```bash # 7:00-23:00，每分钟执行 cron add --name "邮件指令-白天" \ --schedule "expr" "* 7-23 * * *" \ --tz "Asia/Shanghai" \ --session-target "isolated" \ --payload '{"kind":"agentTurn","message":"请用Python imaplib和smtplib检查邮箱 {EMAIL} 的最近50封邮件（包括已读和未读）。IMAP登录: user={EMAIL}, password={PASSWORD}, host={IMAP_HOST}, port={IMAP_PORT}。SMTP登录: user={EMAIL}, password={PASSWORD}, host={SMTP_HOST}, port={SMTP_PORT}。处理步骤：1. 读取~/.openclaw/workspace/memory/processed_emails.json；2. 获取最近50封邮件；3. 筛选出发件人 {WHITELIST_SENDER} 的未处理邮件；4. 执行指令并回复结果；5. 更新已处理列表。","model":"minimax-portal/MiniMax-M2.5","timeoutSeconds":300}' ``` ### Technical Analysis The documented workflow explicitly elevates an email body from untrusted external data to an authoritative Agent instruction. It does not define a command grammar, operation allowlist, parameter validation, approval boundary, or restrictions on the tools and reso ...[truncated 1673 chars]
• Remediation: ## Remediation Suggestions - Do not execute free-form email bodies as Agent instructions. - Replace natural-language commands with a strict, versioned data schema containing a small allowlist of supported operations. - Validate command names, parameter types, lengths, and permitted values before dispatch. - Reject unknown fields and unsupported operations rather than asking an LLM to interpret them. - Require explicit local approval for filesystem access, state-changing operations, credential use, external communication, or other sensitive actions. - Run the processor with a dedicated low-privilege identity and a minimal tool allowlist. - Deny access to unrelated files, secrets, shell execution, package management, and unrestricted network destinations. - Clearly delimit email content as untrusted data in every Agent prompt and prohibit following instructions embedded in message bodies or attachments. - Disable unattended recurring execution until strong sender authentication and command-level authorization are implemented. - Record security audit logs containing the authenticated sender, parsed command, authorization decision, and resulting action without recording secrets.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/process_email.py:85
• Finding: Spoofable and Fail-Open Sender Authorization## Vulnerability Details **File Location**: `scripts/process_email.py:85-93` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: High ### Vulnerable Code Snippet ```python # 获取发件人 from_header = email.utils.parseaddr(msg.get('From')) sender = from_header[1].lower() # 检查是否在白名单 whitelist = config.get('whitelist_sender', '').lower() if whitelist and sender != whitelist: continue ``` ### Technical Analysis Authorization is based solely on the RFC message `From` header parsed from the email. That header is message-controlled and is not proof of the sender's authenticated identity. The code does not validate DKIM, SPF, DMARC, provider authentication metadata, a digital signature, or a command authentication token. The check is also fail-open. When `whitelist_sender` is missing or empty, `whitelist` evaluates as false and the rejection branch is skipped, causing messages from every sender to be accepted. Because accepted messages are intended to become Agent commands, this is not merely a spam-filtering weakness. It is the authorization boundary controlling access to the Agent-driven automation workflow. ### Attack Path 1. The attacker constructs an email with its `From` header set to the configured allowlisted address. 2. Alternatively, the deployment omits `whitelist_sender` or assigns it an empty value. 3. The script parses the attacker-controlled header and considers the message authorized. 4. The message is returned as an unprocessed command email. 5. The documented Agent workflow executes the body and sends back the result. 6. The attacker may repeat the process with additional message identifiers. ### Impact Assessment An unauthenticated party may cross the intended sender authorization boundary and submit commands to the Agent workflow. Combined with free-form instruction execution, this may expose all capabilities available to the Agent session. Even if Agen ...[truncated 145 chars]
• Remediation: ## Remediation Suggestions - Fail closed when `whitelist_sender` is missing, empty, malformed, or ambiguous. - Require cryptographic message authentication, such as a detached signature over a canonical command payload or a strong message authentication code. - Where available, validate trusted provider-supplied authentication results for DKIM, SPF, and DMARC; do not rely on a message-provided authentication header. - Bind authorization to both a verified sender identity and a specific allowed command set. - Normalize addresses carefully and use an explicit array of authorized identities rather than a permissive empty default. - Reject forwarded, resent, malformed, or multiply specified sender fields unless a documented verification policy handles them. - Add replay protection using stable IMAP UIDs or signed command nonces rather than mailbox sequence numbers. - Add tests proving that absent configuration, spoofed headers, malformed addresses, and unauthorized senders are rejected.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/process_email.py:131
• Finding: Unrestricted Local File and Agent Output Exfiltration over SMTP## Vulnerability Details **File Location**: `scripts/process_email.py:131-141`, `scripts/process_email.py:173-183`, `references/01-config-template.md:28-37` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code Snippet `scripts/process_email.py:131-141`: ```python def reply_email(config, original_subject, reply_content): """回复邮件""" msg = MIMEText(reply_content, 'plain', 'utf-8') msg['Subject'] = f"Re: {original_subject}" msg['From'] = config['email'] msg['To'] = config['whitelist_sender'] smtp = smtplib.SMTP_SSL(config['smtp_host'], config['smtp_port']) smtp.login(config['email'], config['password']) smtp.sendmail(config['email'], [config['whitelist_sender']], msg.as_string()) smtp.quit() ``` `scripts/process_email.py:173-183`: ```python def cmd_reply(args): """回复邮件""" config = load_config() # 读取回复内容 if args.content_file: with open(args.content_file, 'r', encoding='utf-8') as f: content = f.read() else: content = args.content ``` `references/01-config-template.md:28-37`: ```text 4. 对每封未处理邮件： a. 解析邮件内容，这就是你需要执行的指令 b. 尝试执行该指令（查询天气/搜索信息/执行操作等） c. 将执行结果（或失败信息）作为邮件正文，用SMTP回复给发件人 - 执行成功：正文写实际执行结果 - 执行失败：详细说明失败原因 d. 将该邮件UID添加到已处理列表 5. 保存更新后的已处理列表到~/.openclaw/workspace/memory/processed_emails.json 【重要】无论成功还是失败，都必须回复邮件！ ``` ### Technical Analysis The `reply --file` interface accepts an arbitrary path and reads the entire file without restricting it to an approved output directory. The resulting contents are transmitted through SMTP without sensitivity classification, secret detection, redaction, output-size limits, or user approval. Independently, the Agent workflow mandates that successful results and detailed failure information be emailed. An attacker-controlled command can therefore request sensitive information an ...[truncated 1588 chars]
• Remediation: ## Remediation Suggestions - Remove arbitrary `--file` support or restrict it to a dedicated output directory using canonical-path validation. - Reject symbolic links, device files, directories, oversized files, and paths escaping the approved directory. - Return structured status summaries rather than unrestricted command output. - Apply secret detection and redaction for credentials, tokens, private keys, cookies, connection strings, personal data, and internal paths. - Set strict message-size and line-count limits. - Require explicit approval before transmitting file contents, tool output, or potentially sensitive error details. - Send generic external failure messages while retaining detailed diagnostics only in protected local logs. - Bind each reply to the authenticated original sender rather than relying only on a globally configured destination. - Apply outbound domain and recipient allowlists and log every transmission decision.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.json:1
• Finding: Mailbox Credentials Are Stored in Plaintext and Embedded in Persistent Agent Tasks## Vulnerability Details **File Location**: `scripts/config.json:1-10`, `references/01-config-template.md:18-20`, `references/01-config-template.md:46-61` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code Snippet `scripts/config.json:1-10`: ```json { // TODO: 请修改为你的实际配置 "email": "[e-mail]", "password": "your_auth_code", "imap_host": "imap.qq.com", "imap_port": 993, "smtp_host": "smtp.qq.com", "smtp_port": 465, "whitelist_sender": "[e-mail]" } ``` `references/01-config-template.md:18-20`: ```text 请用Python imaplib和smtplib检查邮箱 {EMAIL} 的最近50封邮件（包括已读和未读）。 IMAP登录: user={EMAIL}, password={PASSWORD}, host={IMAP_HOST}, port={IMAP_PORT} SMTP登录: user={EMAIL}, password={PASSWORD}, host={SMTP_HOST}, port={SMTP_PORT} ``` `references/01-config-template.md:46-51`: ```bash # 7:00-23:00，每分钟执行 cron add --name "邮件指令-白天" \ --schedule "expr" "* 7-23 * * *" \ --tz "Asia/Shanghai" \ --session-target "isolated" \ --payload '{"kind":"agentTurn","message":"请用Python imaplib和smtplib检查邮箱 {EMAIL} 的最近50封邮件（包括已读和未读）。IMAP登录: user={EMAIL}, password={PASSWORD}, host={IMAP_HOST}, port={IMAP_PORT}。SMTP登录: user={EMAIL}, password={PASSWORD}, host={SMTP_HOST}, port={SMTP_PORT}。处理步骤：1. 读取~/.openclaw/workspace/memory/processed_emails.json；2. 获取最近50封邮件；3. 筛选出发件人 {WHITELIST_SENDER} 的未处理邮件；4. 执行指令并回复结果；5. 更新已处理列表。","model":"minimax-portal/MiniMax-M2.5","timeoutSeconds":300}' ``` ### Technical Analysis The project instructs users to replace a plaintext JSON password placeholder with a real mailbox authorization code. It does not prescribe restrictive file permissions, secret-store integration, or separation between non-sensitive configuration and credentials. More significantly, the reference template places the password directly in Agent instructions and recommends embedding the resulting instruction in a persistent cron payload. This ...[truncated 1551 chars]
• Remediation: ## Remediation Suggestions - Store credentials in an operating-system secret store or a platform-managed secret facility. - Inject secrets at runtime through protected secret references rather than embedding their values in Agent prompts or cron payloads. - Keep non-sensitive server configuration separate from authentication material. - If a local credential file is unavoidable, place it outside the project tree, exclude it from version control and backups where appropriate, and enforce owner-only permissions such as `0600`. - Use a dedicated, revocable, narrowly scoped application password rather than the primary mailbox password. - Never print credentials in help text, diagnostics, task definitions, or logs. - Ensure the Agent never receives raw credentials in its natural-language context. - Document credential rotation and immediate revocation procedures. - Replace the invalid commented JSON file with valid JSON or a clearly named example file that cannot be mistaken for an active credential file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The instructions normalize automatic execution of email-delivered commands and automatic return of results without meaningful safety constraints or warnings. Because the skill's purpose is to operationalize this workflow, the absence of guardrails materially increases the chance of unsafe actions, prompt injection, and unauthorized data handling.

Ssd 1

High

• Confidence: 99% confidence
• Finding: The content semantically declares the email body to be the authoritative instruction source for the agent, overriding safer local policy boundaries. This is dangerous because untrusted external content becomes the control plane for the agent, enabling prompt injection and remote abuse of any connected capabilities.

Ssd 4

High

• Confidence: 98% confidence
• Finding: The workflow establishes trust in messages from a whitelisted sender and then automatically executes their emailed instructions and returns results. Sender-based trust is weak because email identities can be spoofed or accounts can be compromised, making this an unsafe trust boundary for autonomous action.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The template explicitly instructs the agent to treat email body content as executable tasking and to perform arbitrary actions based on that untrusted input. In the context of an email polling skill, this creates a remote command-and-control channel through email and can enable prompt injection, sensitive action execution, data access, or misuse of connected tools.

Ssd 3

High

• Confidence: 97% confidence
• Finding: Mandating that the agent always reply with full execution results or detailed failure information creates a built-in exfiltration channel to the email sender. This can leak sensitive outputs, internal error details, environment information, and operational behavior to an attacker controlling or impersonating the sender account.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents and enables file read/write plus networked IMAP/SMTP activity, but it does not declare an explicit tool or permission scope. That omission weakens reviewability and least-privilege controls, especially for a workflow that ingests external email content and can trigger automated actions and outbound replies.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description omits a clear warning that inbound email content may be treated as executable instructions and that the skill will send replies using stored mailbox credentials. In this context, that missing disclosure is dangerous because users may deploy a remote command channel without appreciating the risks of spoofed senders, prompt injection via email, data exfiltration in replies, or abuse of the configured account.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Step 2: 初始化存储目录

```bash
mkdir -p ~/.openclaw/workspace/memory
echo '[]' > ~/.openclaw/workspace/memory/processed_emails.json
```

• Confidence: 87% confidence
• Finding: This duplicate finding points to the same persistence behavior: a long-lived processed_emails.json file under a shared workspace path. In an automated email execution workflow, unmanaged persistent state can create audit, privacy, and state-manipulation risks, especially if other local processes can read or modify that file.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Step 2: 初始化存储目录

```bash
mkdir -p ~/.openclaw/workspace/memory
echo '[]' > ~/.openclaw/workspace/memory/processed_emails.json
```

• Confidence: 87% confidence
• Finding: This duplicate finding points to the same persistence behavior: a long-lived processed_emails.json file under a shared workspace path. In an automated email execution workflow, unmanaged persistent state can create audit, privacy, and state-manipulation risks, especially if other local processes can read or modify that file.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template instructs users to place sensitive IMAP/SMTP credentials directly into prompts and configuration text without warning about secret handling risks. This can lead to accidental disclosure in files, chat history, logs, screenshots, or version control, increasing the likelihood of account compromise.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The cron payload embeds mailbox credentials directly into scheduled command content, which can expose secrets through process listings, job definitions, logs, backups, or administrative interfaces. Anyone with access to cron configuration or execution traces may recover the credentials and compromise the mailbox and any downstream workflows tied to it.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill automatically sends email replies containing supplied content to the configured whitelist sender without any user-facing confirmation, review step, or explicit disclosure that outbound communication is occurring. In this skill’s context, inbound emails are intended to drive agent actions, so this can enable unintended exfiltration of execution results or sensitive data via email if downstream components pass unsafe content into the reply path.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The natural-language instructions and operational description are presented only in Chinese, which can impose a language constraint on users without opt-in. The file does not state that the skill is region-specific or provide an alternative language option.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The cron examples hardcode the timezone to Asia/Shanghai, which imposes a locale-specific setting without indicating that users may choose a different timezone. This is a natural-language/configuration policy concern because the file does not present the locale as optional or justified for a region-specific tool.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The inline comment is written only in Chinese ('请修改为你的实际配置'), which imposes a specific language in the skill file without offering an alternative or documenting that the skill is intended only for Chinese-speaking users. This matches the policy category for language or locale constraints expressed in natural language.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The natural-language documentation and CLI messages are presented only in Chinese, with no indication that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without offering opt-in or alternatives.

Static analysis

No suspicious patterns detected.