email-pro-optimized

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 2.2.1

Overview

This is mostly a real email tool, but it bundles unrelated repository-publishing and workspace-sync scripts plus exposed Outlook OAuth credentials, so it needs review before use.

Install only after removing or ignoring the auto-push and sync-updates scripts, replacing the bundled Outlook OAuth credentials with your own rotated values, and checking OAuth consent scopes. Treat ~/.openclaw/credentials/email-accounts.json and oauth_tokens.json as secrets because they can expose mailbox access; avoid running maintenance or account-listing commands in shared logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd, cwd=None):
    """运行命令"""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            cwd=cwd or SKILL_DIR,

• Confidence: 95% confidence
• Finding: result = subprocess.run( cmd, shell=True, cwd=cwd or SKILL_DIR, capture_output=True, text=True, timeout=30 )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and documents capabilities that read local credential files, write OAuth tokens, make network requests, and invoke shell commands, yet it declares no permissions. This creates a transparency and consent failure: users or the platform may grant the skill broader effective access than they realize, increasing the chance of credential exposure or unintended local/remote side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior goes beyond a simple mail client: it includes local OAuth callback handling, credential persistence and refresh, metadata modification, workspace synchronization, and even git add/commit/push to a remote repository. These extra behaviors materially expand the attack surface and can lead to unauthorized code/data changes or exfiltration, especially because they are not reflected in the high-level purpose statement.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The README publishes concrete Outlook OAuth values including a client ID, client secret, and tenant ID. Even if these are test or low-privilege values, exposing live-looking OAuth credentials in documentation materially increases the risk of unauthorized use, credential abuse, and downstream compromise of associated mail resources or cloud app registrations.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The README includes specific personal-looking email addresses, account aliases, and mailbox role annotations that are not necessary to explain usage. This unnecessarily discloses identifiers that can enable phishing, account targeting, social engineering, or privacy harm, especially in a tool that manages email accounts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script auto-commits and pushes repository contents to GitHub, behavior unrelated to the advertised email-processing functionality. In a skill context, hidden or bundled code-publishing automation increases the risk of unintended data exfiltration, especially if secrets, local changes, or unrelated files are present in the repository.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code combines shell-based Git execution with remote push capability despite the skill being described as an email tool. This mismatch makes the behavior more suspicious and more dangerous, because it enables code publication and outbound transmission that users would not reasonably expect from this skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The `list_accounts` command enumerates all configured local email accounts and prints account names, email addresses, providers, status, and notes from a credentials file. This increases unnecessary exposure of sensitive local configuration data and expands the tool's access surface beyond the core read/send mail functionality described, making account discovery easier for a user, agent, or downstream log collector that should not need this information.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The maintenance script reads a user OAuth token store from the home directory and prints account names and providers. Even if it does not exfiltrate tokens, accessing unrelated credential material and enumerating identities expands the skill's data access beyond its stated email-performance purpose and can leak sensitive account metadata to logs, terminals, or calling systems.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The README documents capabilities to send email, attach files, and automatically store OAuth credentials/tokens, but it does not prominently warn users that the tool can act on private mailbox data and transmit content externally. In an email-management skill, the combination of message access plus outbound sending raises meaningful privacy and integrity risk if users misunderstand what the tool will do.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README explains where credentials and OAuth tokens are stored and claims file permissions, but it does not clearly instruct users to treat those files as secrets or describe the consequences of leakage. Because these files can provide persistent mailbox access, insufficient warning increases the chance of mishandling, accidental commits, or insecure backups.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to send email and store OAuth/client credentials locally, but it does not warn that message contents, recipients, access tokens, client secrets, and authorization codes are privacy-sensitive and may persist on disk. In an email-management context, this omission is particularly risky because the data handled can directly grant mailbox access and expose personal or business communications.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script silently reads credentials from a local secrets file and immediately logs into the user's mailbox, then processes mailbox contents at scale. In the context of an agent skill, this is sensitive because it accesses private communications without an explicit consent prompt, scoped authorization check, or data-minimization controls, increasing the risk of unintended mailbox surveillance or misuse if invoked unexpectedly.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script hardcodes an Outlook OAuth client secret directly in a distributed shell script, exposing a credential that should never be embedded in source. If this skill is shared publicly, anyone can reuse the client credentials to impersonate the application, abuse API quotas, or facilitate unauthorized OAuth flows against the associated Azure app registration.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The CLI requires OAuth client secrets to be passed directly as command-line arguments, which can expose them through shell history, process listings, audit logs, and job runners. In a credential-handling authorization tool, this is a real secret-management weakness because the tool normalizes an unsafe input pattern without warning users about the exposure risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The main flow stages all changes, commits them, and attempts to push to origin automatically with no interactive confirmation. This can publish unintended modifications, secrets, or sensitive repository contents to a remote service, especially if the script is run in an automated or trusted workflow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script accesses OAuth credential data and displays account details without clear disclosure in the user-facing description. Hidden inspection of locally stored credentials undermines informed consent and can reveal sensitive account inventory information to anyone with access to command output or captured logs.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: OAuth access and refresh tokens are persisted in cleartext to a predictable file under the user's home directory, with no user-facing warning or consent flow about local secret storage. Even though the file is chmod'd to 0600, plaintext persistence increases exposure to local compromise, backups, accidental inclusion in support bundles, or other processes running as the same user.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The credential-check routine prints account information derived from a local OAuth token store in plain-language output. This creates an unnecessary disclosure channel for sensitive user/account metadata, especially in shared terminals, CI logs, screenshots, or remote agent traces, and is more concerning because the skill is expected to handle email identities and tokens.

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.