email-suite (imap+smtp)

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 1.2.6

Overview

This email skill mostly does what it claims, but it needs careful review because it can send mail, alter and permanently delete mailbox data, store credentials locally, and write attachment files with weak safety controls.

Install only if you are comfortable giving this skill mailbox-level access. Use an app password or limited account, run chmod 600 .env, avoid disabling TLS verification except in controlled local testing, treat .cache and downloaded attachments as sensitive, and be very careful with delete/download/test commands because they can permanently change mail, send a test email, or write files locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The function is named and described as a connection test, but it performs a real sendMail() to SMTP_USER after verify(). In an agent skill context, that side effect can surprise users, trigger outbound email without explicit consent, and leak operational metadata or create unintended messages.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The header claims the script only creates a .env with credentials, but it also performs npm installation and executes Node-based IMAP/SMTP connection tests. This is security-relevant because users may provide live credentials expecting passive setup, while the script actually makes outbound network connections and runs project code.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README explicitly states that inbox data is cached locally and attachments are saved under `.cache/attachments/`, but it does not clearly warn that sensitive email bodies, metadata, and downloaded files persist on disk. In an agent-oriented email tool, this can expose confidential communications to other local users, backups, or later processes if the cache is not protected or cleared.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents a permanent `delete` capability but does not prominently warn about irreversible data loss or recommend safer alternatives such as archive/trash semantics or confirmation prompts. In an email-management skill, destructive operations are high-risk because users may invoke them on important messages or multiple UIDs, causing accidental loss.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill supports sending email bodies and attachments to external mail servers but does not clearly warn that message contents, metadata, and attached files leave the local environment. This can lead users to unintentionally transmit sensitive data through third-party infrastructure or to unintended recipients.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation explicitly recommends `IMAP_REJECT_UNAUTHORIZED=false` and `SMTP_REJECT_UNAUTHORIZED=false` for self-signed certificates without a strong warning that this disables certificate validation. Disabling TLS verification exposes credentials and email contents to man-in-the-middle attacks by allowing attackers to impersonate mail servers.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The module stores inbox metadata in a predictable local cache under the working directory without any warning, opt-in, or permission hardening. In an agent/skill context, this can silently persist sensitive email subjects, senders, dates, and state to disk where other local users, processes, backups, or later workflows may access them.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Fetching a message marks it as read by default, which changes remote mailbox state as a side effect of a read-only seeming operation. In an automated agent setting, this can destroy the user's unread triage signal, alter auditability of whether a human reviewed the message, and create irreversible workflow errors without clear consent.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The delete command marks messages as deleted and immediately expunges them without confirmation, dry-run, or safety interlock. In an agent skill, a mistaken UID, prompt injection, or automation error could permanently remove user email with little opportunity for recovery, making this a high-impact destructive action.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Attachment filenames from email are joined directly into a destination path and written to disk, with no sanitization or containment checks. A malicious attachment name containing path traversal sequences or absolute paths could cause writes outside the intended directory, potentially overwriting arbitrary local files in the agent's execution context.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash

# IMAP/SMTP Email Suite Setup
# Creates .env with email credentials

set -e

• Confidence: 88% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

EOF

    if [ -n "$EMAIL_SIGNATURE" ]; then
        cat >> .env << EOF

# Email Signatures
EMAIL_SIGNATURE="$EMAIL_SIGNATURE"

• Confidence: 86% confidence
• Finding: .env

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/utils/imap.js:17