Security audit

mail-messenger

Security checks for vulnerabilities and agentic risk

Overview

The mail functions are mostly as advertised, but the skill also adds persistent self-learning records and possible skill-file changes without clear limits.

Review before installing. Use it only if you are comfortable with outbound email/webhook actions and with a local learned_patterns.json file storing usage notes and preferences. Keep credentials in environment variables, confirm recipients and webhook URLs before sending, and avoid putting message contents, addresses, secrets, or account details into learner notes; remove or disable the learner if you do not need persistent learning.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents access to environment-provided secrets and also a self-improvement workflow that records outcomes and may modify files, yet no permissions are explicitly declared. This creates a transparency and containment problem: users and the platform may not realize the skill can consume sensitive credentials and write persistent state, increasing the chance of unsafe use or privilege creep.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is mail and message delivery/retrieval, but the skill also includes a generic learner system that records failures, preferences, and can 'write back' changes to the skill file. Hidden persistence and self-modification materially expand the trust boundary and can capture behavioral metadata unrelated to the core function, which is especially risky in a mail-handling context.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: Embedding a self-improvement loop inside a mail assistant introduces persistent telemetry collection and potential self-modification in a workflow that handles communications and credentials. Even if intended for reliability, recording every send/retrieval and rewriting the skill file can leak sensitive operational context and make future behavior drift without clear review.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Recording usage outcomes and user preferences is not necessary for sending mail or fetching messages, so it represents data collection beyond the principle of least privilege. In practice this can accumulate behavioral profiles, service-provider preferences, and failure histories that may reveal sensitive user habits or account details.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The safety section promises not to read or send private mail content externally, but the learner loop says every send/retrieval should be recorded, creating a policy contradiction. Contradictory safety claims are dangerous because they can mislead users about what metadata is persisted and increase the chance that sensitive message attributes or outcomes are captured unintentionally.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file implements a generic cross-skill learning and telemetry component that is materially broader than the declared mail/messaging purpose of the skill. In this context, that scope mismatch is dangerous because it enables persistent collection of usage data and preferences across arbitrary skills, creating an unjustified data-retention and surveillance capability inside a narrowly scoped assistant.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code persists arbitrary user preferences, recent operations, error notes, and capability history to disk for any supplied skill directory. That is risky because notes and preferences can contain sensitive content, and the mail/messaging context makes incidental storage of message-related metadata especially privacy-sensitive and beyond the stated need of simply sending or reading mail.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases include broad everyday expressions such as '通知我' and '把结果发到邮箱', which can cause the skill to activate in contexts where the user did not intend mail or outbound messaging. Mis-triggering is risky here because the skill can handle credentials and perform external communications, so unintended invocation could expose data or initiate unwanted sending actions.

Static analysis

No suspicious patterns detected.