T09 · Insecure Skill Coding Practices
Error
- Location
scripts/authorize-outlook.sh:5- Finding
Hard-Coded Azure OAuth Client Secret
- Content
View full analysis
- Remediation
View remediation
Security audit
email-pro-optimized
Security checks for vulnerabilities and agentic risk
Overview
This email skill has real email functionality, but it also ships insecure OAuth handling and unrelated repository/workspace automation that users should review before installing.
Install only if you are comfortable reviewing and controlling the scripts yourself. Use your own OAuth application credentials, revoke the exposed Azure secret if it belongs to you, avoid the bundled auto-push and sync maintenance scripts, and treat ~/.openclaw/credentials as sensitive because it can contain mailbox credentials and refresh tokens.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/oauth_handler.py:20- Finding
OAuth Login CSRF and Account Confusion Due to Missing State Validation
- Content
View full analysis
Authorization Success!
' b'You can close this window now.
' ) else: self.send_response(400) self.end_headers() ``` The authorization URL is generated without a `state` value: ```python params = { 'client_id': self.client_id, 'redirect_uri': self.redirect_uri, 'response_type': 'code', 'scope': 'https://www.googleapis.com/auth/gmail.modify', 'access_type': 'offline', 'prompt': 'consent' } return f"{self.auth_uri}?{urlencode(params)}" ``` The Outlook authorization flow has the same omission. ### Technical Analysis OAuth authorization requests must contain an unpredictable, single-use `state` value that is bound to the initiating session. The callback must reject responses whose state does not match. This implementation accepts the first request to the local callback containing any `code` parameter without verifying that the callback belongs to the authorization attempt initiated by the user. The authorization code is also held in the class variable `OAuthCallbackHandler.auth_code` and is not reset before starting ...[truncated 1693 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/auto-push.py:14- Finding
Shell Command Injection Through Git Branch Name
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/auto-push.py:46- Finding
Undeclared Bulk Staging and Remote Publication of Repository Files
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/sync-updates.py:14- Finding
Undeclared Modification of a Separate Agent Workspace
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/analyze.py:46- Finding
Email Analyzer Retrieves Full Messages Despite Using Only Headers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (50)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The README explicitly documents local storage of OAuth access and refresh tokens in a file under the user's home directory. If those tokens are stored unencrypted or exposed through weak file permissions, backups, logs, sync tools, or local compromise, an attacker could access mailbox contents and potentially send email as the user without knowing the account password.
- Content
md **OAuth Token**: `~/.openclaw/credentials/oauth_tokens.json` Automatically saved after authorization, contains access token and refresh token. #### Gmail Mailbox (Optional)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents a general-purpose, high-performance email toolkit with IMAP read, SMTP write, OAuth 2.0, and concurrency across major providers. The supplied code instead performs a narrow task: it reads messages from an inbox over IMAP using locally stored credentials, parses subjects/senders, classifies emails, and outputs summary statistics. There is no SMTP functionality, no OAuth flow, no concurrent processing, and no clear implementation of provider-specific support for QQ/Gmail/Outlook. The primary purpose is materially different as well: this is an email analysis script, not a full email client/toolkit. Therefore the declared description does not accurately represent the observed behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a full-featured email tool covering QQ, Gmail, and Outlook, with IMAP/SMTP functionality, OAuth 2.0, concurrency, and performance claims. The supplied code chunk only defines a CLI wrapper for OAuth authorization, exposing subcommands for Gmail and Outlook and forwarding credentials to authorization handlers. This is only a narrow subset of the declared functionality (OAuth 2.0 for two providers) and lacks the primary advertised behaviors of reading/sending email, QQ support, and concurrent processing. Therefore, the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about email functionality (IMAP/SMTP/OAuth/concurrency/performance), but the actual code chunk contains no email-related logic at all. Instead, it performs source-control automation for a local skill directory: running git commands, enumerating changed files, committing them, and pushing to a remote repository. This is a materially different primary purpose and introduces undeclared capabilities involving local file/repository management and remote code publication. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 84% confidence
- Finding
The core purpose mostly aligns at a high level: this is an email utility that can read/search/fetch and send mail for configured accounts. However, the declared description makes specific claims about OAuth 2.0 support, concurrent processing, and high-performance behavior, including a 4-5x speed improvement. None of those capabilities are evidenced in this code chunk. Instead, the code mainly provides a command-line wrapper around provider methods and accesses a local credentials file to manage accounts, including listing account metadata, which is not mentioned in the description. Because the declared purpose emphasizes capabilities not substantiated by the code and omits the local account/config management behavior, this is a meaningful description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill is an end-user email tool with IMAP/SMTP/OAuth/concurrent email handling across providers. However, the provided code chunk is not implementing those mail capabilities; it is a maintenance script for the skill package. Its primary purpose is operational upkeep: checking dependencies, verifying required files, reading local credential/token files, validating that another script contains expected symbols, and updating .skill-metadata.json with a bumped version and feature metadata. Those behaviors are materially different from the declared primary purpose. While some references align with the email domain (OAuth, providers, feature names), this chunk itself performs maintenance/admin tasks and local credential inspection, which are undeclared in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a full email tool covering QQ/Gmail/Outlook, IMAP/SMTP operations, OAuth 2.0, and concurrent high-performance processing. The supplied code chunk is much narrower: it handles OAuth flows for Gmail and Outlook only, starts a local HTTP server on localhost:8080 to receive authorization callbacks, opens a browser for user consent, stores OAuth tokens under ~/.openclaw/credentials/oauth_tokens.json, and refreshes Gmail access tokens automatically. This is related to the OAuth portion of the description, but materially incomplete versus the declared primary purpose. Key advertised capabilities—QQ support, IMAP reading, SMTP sending, concurrency, and performance characteristics—are absent from the code shown. Therefore the description does not accurately represent what this specific code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
描述与代码部分一致：确实支持 QQ、Gmail、Outlook，也实现了邮件读取、发送和 OAuth 2.0（Gmail/Outlook）。但存在明显不匹配之处。首先，声明中的“并发处理”在代码中没有任何线程、异步、任务池或批量并发实现。其次，“高性能”“比 imap-smtp-email 快 4-5 倍”没有任何可见优化、基准测试或特殊实现支撑。再次，描述概括为 IMAP 读、SMTP 写，实际只有 QQ 使用 IMAP/SMTP；Gmail 与 Outlook 改为调用 Gmail API 和 Microsoft Graph API，这与声明的协议层能力不完全一致。最后，代码还会访问用户主目录下的 OAuth token 文件以加载凭证，这虽是支持 OAuth 的实现细节，但属于未在描述中明确提及的资源访问。综合看，技能主用途基本相关，但描述对能力和实现方式有实质性夸大/偏差，因此应判定为 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents an end-user email capability: reading mail via IMAP, sending via SMTP, OAuth 2.0 support, provider compatibility, and performance claims. The supplied code does not implement email handling at all. Instead, it is a developer utility script for syncing skill source files, maintaining changelogs, updating version metadata, and preparing/prompting for ClawHub publication. This is a materially different primary purpose and introduces undeclared filesystem and release-management behavior unrelated to the stated email tool functionality.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill contains shell-based Git automation that is not justified by an email tool's stated function. Because it combines shell execution with source-control operations, it can be repurposed to run arbitrary commands or publish repository contents, making the mismatch in context especially risky.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Using shell=True for tool execution creates a parameter-abuse pathway because command strings are assembled and executed by the shell instead of being passed as structured arguments. In this script, dynamic values like branch names and commit content can become part of shell-parsed input, enabling arbitrary command execution if manipulated.
- Content
python def run_command(cmd, cwd=None): """运行命令""" try: result = subprocess.run( cmd, shell=True, cwd=cwd or SKILL_DIR,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file describes actions that can transmit data externally by sending emails, including HTML content and attachments, but it does not include any user warning about verifying recipients, attachment contents, or the privacy implications of outbound mail. The same document also promotes email backup/export and automated checking of mailbox contents, which affect sensitive user data, yet no cautionary disclosure is provided.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The security section states QQ uses an authorization code instead of a password and implies safer credential handling, but the same README shows
auth_code,client_secret, and OAuth tokens being stored in plaintext under~/.openclaw/credentials/. This is an intent/documentation contradiction because the security claims suggest stronger handling than the documented storage practice actually provides.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and instructs use of capabilities that inherently require shell, network access, and reading/writing credential files, yet it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens containment and user awareness, increasing the chance the skill operates with broader agent privileges than necessary when handling sensitive email accounts and OAuth tokens.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill metadata and user-facing documentation are presented in Chinese throughout, with no indication that users may choose another language or that the tool is intentionally limited to a Chinese-speaking or region-specific context. Under the locale policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill provides a straightforward email sending command but does not warn users that execution can trigger real outbound messages to external recipients. In an agent setting, that omission raises the risk of accidental data leakage, unauthorized contact, spam-like behavior, or reputational harm if commands are run with the wrong recipient or content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly stores account credentials and OAuth tokens in local files but does not prominently warn users about the sensitivity, persistence, or protection requirements of those secrets. In an email-management context, compromised local token or credential files can grant ongoing access to mailbox contents and sending capability across multiple providers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script loads stored email credentials from a local secrets file, logs into the mailbox, and reads message contents from the inbox without any explicit user consent prompt, warning, or access-scope confirmation at runtime. In an agent skill context, this is sensitive-data access because it touches both authentication secrets and private mailbox content, increasing the risk of unintended surveillance, overcollection, or misuse if invoked unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script hard-codes an OAuth client ID, client secret, and tenant ID directly in a shell script and immediately invokes the authorization flow. Even if these values are intended for a public integration, embedding a client secret in distributed skill code exposes it to any user or attacker who can read the file, enabling unauthorized reuse of the application credentials and making secret rotation difficult.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code requires OAuth client secrets as command-line arguments for both Gmail and Outlook, which is a sensitive credential-handling operation. The file provides no warning in comments, help text, or runtime output about the security implications of supplying secrets on the command line, where they may be exposed via shell history or process listings.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file adds repository automation that stages, commits, and pushes local changes, which is unrelated to the advertised email-processing purpose of the skill. In a skill package, unrelated source-control automation expands the attack surface and can be used to exfiltrate local code or silently publish unintended changes.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The script executes shell commands through subprocess.run with shell=True, which is dangerous because later calls interpolate variable data such as the current Git branch into command strings. If a branch name or other command component contains shell metacharacters, it can trigger command injection and execute arbitrary commands on the host.
- Content
python def run_command(cmd, cwd=None): """运行命令""" try: result = subprocess.run( cmd, shell=True, cwd=cwd or SKILL_DIR,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The main flow automatically stages all changes, commits them, and pushes to the remote repository without any interactive confirmation step. This can cause irreversible publication of sensitive files, secrets, or unintended modifications, especially if the script is run accidentally or integrated into automated workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The module title, support text, docstrings, CLI description, help strings, and user-facing messages are written in Chinese, and the file does not indicate any user opt-in or alternative locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script's natural-language docstrings and user-facing output are exclusively in Chinese, which effectively fixes the interaction language without offering user opt-in or an explanation that the tool is region-specific. The policy scope includes natural-language content in code files, so this qualifies as a locale/language policy concern.
- Content