Agentmail To

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:18 AM UTC
• Version: 1.0.0

Overview

The skill is for email automation, but it publishes a live-looking API key and relies on unreviewed scripts outside the package.

Review before installing. The exposed AgentMail API key should be treated as compromised and rotated, and the package should replace it with environment-variable or secret-manager instructions. The referenced Python scripts should be included in the skill package or pinned by verified hashes before users run them. Use an isolated environment and avoid using this with sensitive email content until those issues are fixed.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:1

Finding

AgentMail API credential committed in plaintext

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:20

Finding

Skill delegates execution to mutable scripts outside the audited package

Content

View full analysis

``` ```bash python3 /home/pit/.openclaw/workspace/scripts/create_clean_inbox.py ``` ### Technical Analysis The Skill instructs the Agent to execute Python scripts from an absolute path outside the audited project. None of the referenced scripts is present in the supplied package, so their implementation, integrity, ownership, and write permissions cannot be verified. The effective behavior of the Skill can consequently change without modifying any audited file. If another process or user can replace or edit one of these scripts, an apparently legitimate email-management command will execute the substituted Python code. This breaks review boundaries and grants external workspace content control over the Skill's runtime behavior. The external scripts are related to the declared email-management purpose, but unrestricted execution of mutable, unaudited files is not the minimum privilege necessary to implement that purpose. ### Attack Path 1. An attacker gains write access to `/home/pit/.openclaw/workspace/scripts/` or one referenced Python file. 2. The attacker modifies or replaces the expected script with malicious Python code. 3. A user or Agent invokes a documented Skill command. 4. `python3` executes the attacker-controlled file as the invoking operating-system user. 5. The malicious code can access the process environment and any files, credentials, or network resources available to that user. ### Impact Assessment Successful exploitation provides code execution with the privileges of the Agent or user invoking the command. Potential impact includ ...[truncated 324 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned browser automation dependency and installer execution

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation exposes both a live-looking API key and a specific mailbox address without any warning about credential sensitivity, effectively publishing the means and target for email access. This materially increases the risk of unauthorized mailbox access, spoofed outbound email, privacy violations, and operational misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill file directly discloses a live-looking AGENTMAIL_API_KEY, which is a sensitive secret granting email-management capability. Anyone with access to this documentation could reuse the credential to read mail, send messages, or manipulate inboxes, leading to account compromise and abuse of the associated service.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README presents all user-facing instructions in Russian and does not indicate any alternative language option or user choice. Under the policy criteria, forcing a specific language without opt-in is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 113)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 150)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 188)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 195)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 214)May include surrounding context.

Создайте временный email:

bash

curl -X POST https://api.agentmail.to/v1/emails \
  -H "Authorization: Bearer $AGENTMAIL_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 187)May include surrounding context.

md

}
    
    def create_email(self):
        response = requests.post(
            'https://api.agentmail.to/v1/emails',
            headers=self.headers
        )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises capabilities to send replies, create inboxes, and clear messages, but provides no warning about privacy, data handling, or destructive effects. In an email-management context, these actions can expose message content, send unauthorized communications, or delete records, making misuse more dangerous than in a non-communications skill.

Content

No source excerpt is available for this finding.