Security audit

mail-messenger

Security checks for vulnerabilities and agentic risk

Overview

This messaging skill needs review because it handles email credentials and outbound messages while also storing learning data and preferences more broadly than its mail purpose clearly scopes.

Install only if you are comfortable with a mail skill that can send external messages and store local learning history. Use app-specific mail credentials, prefer environment variables or a secret manager instead of --pass, confirm recipients and webhook URLs before sending, and review or disable learned_patterns.json persistence if notes could contain sensitive content.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/smtp_send.py:61
Finding: SMTP Password Exposed Through Process Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/learner.py:77
Finding: Unvalidated Persistent Learning Data Can Poison Future Agent Decisions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a mail and messaging helper, but the document also instructs the agent to record outcomes, persist preferences, and perform reflection/writeback. This hidden behavioral expansion matters because it introduces telemetry and stateful storage that users would not reasonably expect from a simple send/read mail skill, increasing privacy and integrity risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is a mail and messaging helper, but the document also instructs the agent to record outcomes, persist preferences, and perform reflection/writeback. This hidden behavioral expansion matters because it introduces telemetry and stateful storage that users would not reasonably expect from a simple send/read mail skill, increasing privacy and integrity risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file implements a generic cross-skill telemetry and learning component that is materially broader than the declared purpose of a mail/messaging assistant. In skill ecosystems, undeclared cross-cutting data collection is dangerous because it expands the trust boundary, enables collection of behavioral data from unrelated workflows, and can be repurposed for surveillance or persistence beyond user expectations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares capabilities that use environment variables and file-writing behavior via the learner workflow, but it does not scope or disclose those tool permissions. Missing tool scope weakens review and runtime containment, making it easier for a skill that handles credentials and user communications to access sensitive data or persist telemetry without explicit approval.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Broad trigger phrases like '发邮件', '通知我', and '读取邮件' are common natural-language requests and may cause the skill to activate in situations where the user did not intend credential use, mailbox access, or outbound transmission. In a skill capable of reading email and sending messages, accidental activation can lead to privacy exposure or unintended sends.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill advertises email-reading capability without prominent warning that it may access mailbox contents, sender/recipient metadata, and other sensitive personal data. Insufficient disclosure is dangerous because users may invoke it casually without understanding the privacy implications or the need for least-privilege credentials and explicit consent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
text
### 3. 消息通知（机器人 Webhook） - **企业微信群机器人**：`curl -X POST "$WECOM_WEBHOOK" -H 'Content-Type: application/json' -d '{"msgtype":"text","text":{"content":"任务完成"}}'` - **飞书**：POST 到飞书自定义机器人 webhook，body 同上结构。 - **钉钉**：webhook 后需加 `&timestamp=&sign=`（加签模式）。

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The self-improve workflow exceeds the stated role of sending and retrieving messages by introducing persistent learning, failure recording, and reflective modification. That creates an unexpected data retention surface and potential file mutation path, which is risky in a public skill handling credentials and communication metadata.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The safety statement says private mail content will never be sent externally, yet earlier instructions encourage sending long reports and attachments through email and webhooks. This contradiction can mislead users and operators about actual data-flow boundaries, increasing the chance of accidental exfiltration of sensitive content under a false sense of safety.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language instructions, usage text, and user-facing messages in this file are all Chinese, which effectively forces a specific language for users interacting with the tool. The file does not offer an opt-in language choice or justify that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module writes learned_patterns.json containing user preferences and notes without any explicit warning, consent flow, or visible privacy notice. Silent persistence of potentially sensitive free-text notes is risky because users may provide secrets, personal data, or message content assuming it is transient, and those details remain on disk for later access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code persistently stores arbitrary preferences, operational history, error notes, and recent activity for any supplied skill directory, not just this mail assistant. That creates a privacy and cross-skill data exposure risk because user notes may contain sensitive content such as email subjects, recipients, failure details, or internal workflow context, all written to disk without scoping or protection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings exclusively in Chinese, starting with the module docstring that describes the tool. The file does not indicate that the skill is intentionally limited to a Chinese-speaking or region-specific context, nor does it offer a language/locale option, which conflicts with the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script's runtime messages shown to users, including missing-credential errors and send success/failure notices, are only in Chinese. Because there is no opt-in, fallback language, or explicit justification for a Chinese-only audience, this is a natural-language policy violation rather than a code-security issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The docstring frames the module as only recording usage, preferences, insights, and reflection, but self_reflect generates explicit recommendations to '回写本技能 SKILL.md'. While it does not modify SKILL.md directly, the documentation omits this skill-maintenance-oriented behavior and therefore understates the module's intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.