MailWise

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:34 PM UTC
• Version: 1.0.2

Overview

MailWise is a coherent email-search skill that clearly discloses local email indexing and external Claude analysis, with ordinary privacy and supply-chain cautions.

Install only from a trusted source or pinned version, index only approved email archives, avoid showing full threads in shared contexts, and use analyze only when sending selected email excerpts to Anthropic is allowed by your organization's data policy.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5, SKILL.md:51, and reference.md:6
Vulnerability Type: Unpinned and integrity-unverified package dependency
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:5:

yaml

metadata: { "openclaw": { "emoji": "📧", "requires": { "bins": ["mailwise", "claude"], "env": { "ANTHROPIC_API_KEY": { "description": "Anthropic API key (only needed for the 'analyze' command; alternative: authenticate via 'claude' CLI login)", "required": false } } }, "install": [{ "id": "pip", "kind": "uv", "package": "mailwise", "bins": ["mailwise"], "label": "Install MailWise from PyPI" }] } }

SKILL.md:51:

bash

pip install mailwise        # 1. Install from PyPI

reference.md:6:

bash

pip install mailwise

Technical Analysis

The project instructs the Agent or user to install mailwise from PyPI without specifying an audited version, cryptographic hash, or immutable source revision. The installation metadata similarly names only the mutable package identifier.

Consequently, the code installed during separate deployments is not guaranteed to be the code that was reviewed. A compromised maintainer account, malicious future release, or compromise of the package distribution channel could cause installation or execution of attacker-controlled code. Depending on the package format and installer configuration, malicious behavior could occur through package build hooks during installation or when the installed mailwise executable is invoked.

The reviewed project contains only Markdown documentation and does not include the dependency source, so the actual behavior of the installed executable cannot be independently verified from this artifact.

Attack Path

1. An attacker compromises the mailwise package publishing account, its release pipeline, or another part of the package distribution channel.
2. The attacker publishes a malicious vers ...[truncated 1417 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version, for example:

   bash

   pip install mailwise==X.Y.Z
   

2. Require cryptographic hashes through a locked requirements file:

   text

   mailwise==X.Y.Z --hash=sha256:EXPECTED_HASH
   

   Install it with hash verification enabled:

   bash

   pip install --require-hashes -r requirements.txt
   

3. Update the Skill installation metadata so it resolves the same exact reviewed version rather than the latest release.

4. Record the upstream repository and immutable source commit corresponding to the approved package.

5. Audit the package source, build configuration, transitive dependencies, and published artifact before approving a version.

6. Use a trusted internal package mirror or allowlist when deploying in environments containing sensitive email archives.

7. Run installation and MailWise commands under a minimally privileged account, with access restricted to only the required email and index directories.

8. Avoid exposing unrelated secrets to the process environment; provide the Anthropic credential only when the external analysis feature is explicitly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation says mailwise analyze produces a Claude-generated analysis but does not warn that email-derived content may be transmitted to an external AI service. Because the skill is specifically designed to search past bugs and incidents from local email archives, this can lead to unintentional disclosure of confidential incident data, credentials, customer information, or internal engineering discussions to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reference instructs users to index and later display email threads, including message bodies, senders, dates, and participant identities, but provides no warning that this process can expose sensitive communications and personal data. In a knowledge-base tool centered on historical incident emails, omission of this privacy/security warning increases the risk that users will ingest or reveal confidential content without appropriate review or access controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.