Security audit

docker-mailbox

Security checks for vulnerabilities and agentic risk

Overview

This skill gives an agent access to a user-controlled mailbox service for reading, sending, and deleting email, and it clearly discloses the sensitive permissions and safety steps.

Install only if you intend to let an agent operate your email through docker-mailbox. Keep the service bound to localhost unless you deliberately expose it, use long bearer tokens, protect config.yaml and tunnel credentials like passwords, confirm exact message UIDs before deletion, and prefer pinned Docker image versions or digests instead of ':latest'.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (18)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
For installation and setup, see [references/setup.md](references/setup.md).

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
"$MAILBOX_URL/mailboxes/personal/messages/1234?folder=INBOX"

text
`DELETE /mailboxes/<name>/messages/<uid>` permanently removes a message (`\Deleted` + `EXPUNGE`, no undo). Confirm the target `mailbox`/UID first — see [Security & safety](#security--safety). `/messages` `search` is **raw IMAP SEARCH** (e.g. `ALL`, `UNSEEN`, `FROM foo@bar`, `(UNSEEN FROM foo@bar)`). `/search` is the structured query DSL — same params as `/inbox` minus `mailbox`. Use whichever's easier.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
Status codes: | Status | When | | ------ | ------------------------------------------------------------------------------------------ | | `401` | Missing or invalid bearer, or no server tokens configured. | | `404` | Unknown mailbox name in the URL. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
`GET /inbox` fans out across **every IMAP-configured mailbox** in parallel, runs the same structured search against each one, merges newest-first, and tags each message with which account it came from. Per-mailbox failures land in `errors` instead of aborting the whole call. | Query param | What it does | | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `mailbox` | CSV filter by mailbox name (`personal`) **or** email address (`me@gmail.com`). Omit to search all IMAP mailboxes. | | `from`, `to`, `subject`, `body`, `text` | IMAP SEARCH predicates. `text` is full-text across headers + body. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `mailbox` | CSV filter by mailbox name (`personal`) **or** email address (`me@gmail.com`). Omit to search all IMAP mailboxes. | | `from`, `to`, `subject`, `body`, `text` | IMAP SEARCH predicates. `text` is full-text across headers + body. | | `since`, `before` | IMAP date filters, e.g. `1-Jan-2026`. | | `unseen`, `seen`, `flagged`, `answered` | Boolean flag filters. | | `larger_than`, `smaller_than` | Size filters in bytes. | | `folder` | IMAP folder name (default `INBOX`). |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
| `mailbox` | CSV filter by mailbox name (`personal`) **or** email address (`me@gmail.com`). Omit to search all IMAP mailboxes. | | `from`, `to`, `subject`, `body`, `text` | IMAP SEARCH predicates. `text` is full-text across headers + body. | | `since`, `before` | IMAP date filters, e.g. `1-Jan-2026`. | | `unseen`, `seen`, `flagged`, `answered` | Boolean flag filters. | | `larger_than`, `smaller_than` | Size filters in bytes. | | `folder` | IMAP folder name (default `INBOX`). | | `limit` | Max merged results, ≤ 500 (default 50). |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
| `from`, `to`, `subject`, `body`, `text` | IMAP SEARCH predicates. `text` is full-text across headers + body. | | `since`, `before` | IMAP date filters, e.g. `1-Jan-2026`. | | `unseen`, `seen`, `flagged`, `answered` | Boolean flag filters. | | `larger_than`, `smaller_than` | Size filters in bytes. | | `folder` | IMAP folder name (default `INBOX`). | | `limit` | Max merged results, ≤ 500 (default 50). |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
| since, before | IMAP date filters, e.g. 1-Jan-2026. | | unseen, seen, flagged, answered | Boolean flag filters. | | larger_than, smaller_than | Size filters in bytes. | | folder | IMAP folder name (default INBOX). | | limit | Max merged results, ≤ 500 (default 50). |

bash

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
| unseen, seen, flagged, answered | Boolean flag filters. | | larger_than, smaller_than | Size filters in bytes. | | folder | IMAP folder name (default INBOX). | | limit | Max merged results, ≤ 500 (default 50). |

bash
# everything from one sender, all accounts

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
"$MAILBOX_URL/inbox?mailbox=personal,work&unseen=true" | jq # everything since yesterday, full-text "invoice" curl -s -H "Authorization: Bearer $MAILBOX_TOKEN" \ "$MAILBOX_URL/inbox?since=$(date -d 'yesterday' +%-d-%b-%Y)&text=invoice" | jq # search a specific folder (e.g. Spam)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
bash
# Folders curl -s -H "Authorization: Bearer $MAILBOX_TOKEN" \ $MAILBOX_URL/mailboxes/personal/folders # List newest-first headers — raw IMAP SEARCH criteria

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
md
MARKER="e2e-$(uuidgen | cut -c1-8)" # 1. Send marker to self curl -s -X POST -H "Authorization: Bearer $MAILBOX_TOKEN" \ -H 'Content-Type: application/json' \ -d "{\"to\": [\"me@gmail.com\"], \"subject\": \"ping $MARKER\", \"body_text\": \"$MARKER\"}" \ "$MAILBOX_URL/mailboxes/personal/send"

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/setup.md (reported line 85)May include surrounding context.
md
- Each mailbox must declare at least one of `imap` / `smtp`. Both is fine. Neither is a config error. - **`name`** is the URL path segment AND the MCP tool prefix. Matches `[a-zA-Z0-9_-]+`. Must be unique across the file. - **Defaults**: IMAP `993/ssl`, SMTP `587/starttls`. Override per-mailbox if your provider is weird. - **The config file holds plaintext passwords and your bearer tokens.** Treat it like a credential vault: gitignore it (the repo already does), `chmod 600`, mount read-only into the container, don't paste it in chat. ### Provider quick-reference

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/setup.md (reported line 103)May include surrounding context.
md
## Ports | Port | Service | | ---- | ---------------------------------------------------------------------------------------- | | 8000 | HTTP API (`/health`, `/mailboxes`, `/inbox`, `/mailboxes/<name>/...`) AND MCP at `/mcp` |

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/setup.md (reported line 161)May include surrounding context.
bash
# Install cloudflared curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o /tmp/cloudflared sudo install /tmp/cloudflared /usr/local/bin/cloudflared # Authenticate and create tunnel cloudflared tunnel login

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: The instructions copy long-lived Cloudflare tunnel credentials into a local project directory, which creates a persistent secret on disk that could be exposed through weak filesystem permissions, backups, or accidental inclusion in archives. In the context of this skill, those credentials can provide durable remote access to a mailbox service that handles sensitive email data, increasing the impact of secret leakage.
Content: Scanner excerpt · references/setup.md (reported line 163)May include surrounding context.
md
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o /tmp/cloudflared sudo install /tmp/cloudflared /usr/local/bin/cloudflared # Authenticate and create tunnel cloudflared tunnel login cloudflared tunnel create mailbox

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/setup.md (reported line 212)May include surrounding context.
md
## Troubleshooting | Symptom | Likely cause | | -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | `401 missing or invalid Bearer token` | Forgot `-H "Authorization: Bearer ..."` or token doesn't match anything in `auth.tokens`. | | `502 login failed` | Wrong password OR you used your account password instead of an app password (Gmail/Yahoo/iCloud/Outlook). |

Static analysis

No suspicious patterns detected.