ClawHub
Back to skill

Security audit

Agentmail

Security checks across malware telemetry and agentic risk

Overview

This AgentMail skill is a coherent email automation integration, but users should configure webhooks and external forwarding carefully because email can contain sensitive or untrusted content.

Install only if you intend to give agents email-sending, receiving, and webhook abilities. Configure webhook signature verification before exposing endpoints, restrict webhooks to specific inboxes and event types, use sender allowlists for automated actions, and review or redact email content before forwarding it to GitHub, Slack, logs, or other third-party systems.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs users to read an API key from an environment variable and includes executable code snippets that access `os.getenv("AGENTMAIL_API_KEY")`, but the skill declares no permissions or capability metadata for environment access. In an agent setting, undeclared secret access reduces transparency and can lead to over-privileged execution or accidental exposure of credentials during tool use, logging, or prompt-injected workflows.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The example expands from email handling into creating GitHub issues via a separate third-party API, which increases the skill's effective privilege and data-sharing scope beyond its stated email-platform purpose. In an agent context, this can cause operators to unknowingly permit cross-system actions and data propagation from inbound email into external services.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The local-development webhook receiver accepts unauthenticated POSTs and immediately performs a privileged outbound action: sending email from the inbox. Even if labeled for development, readers often reuse sample code in production or expose it via ngrok as shown here, so an attacker who can reach the endpoint could forge webhook payloads and trigger unauthorized emails, spam, or workflow abuse.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The webhook feature is documented as sending real-time events to an arbitrary external URL, but the reference omits any warning that message metadata or content may be transmitted off-platform. In an agent email product, this can lead users to unintentionally exfiltrate sensitive inbound email data to third-party endpoints they do not control or have not secured.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The example forwards the sender's email address and message body to GitHub without warning, minimization, or consent handling. This is dangerous because inbound email often contains personal, confidential, or regulated information that should not be automatically disclosed to another platform.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The guide promotes automatic processing of full inbound email content and automated replies without clearly warning that message bodies, attachments, and sender addresses may contain sensitive data and that the system may take outbound actions automatically. In an agent-email platform, this can lead users to deploy privacy-impacting or abuse-prone workflows without informed consent, especially when routing content to third-party services or auto-responding to arbitrary senders.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The test webhook receiver logs the full incoming webhook payload, which can include sensitive email content, sender/recipient data, and message metadata. Because this skill is specifically for agent-managed email workflows, the payload is likely to contain real user communications, so console logs can become an unintended disclosure channel through terminal history, log aggregation, screenshots, or shared development environments.

Ssd 3

Medium
Confidence
97% confidence
Finding
The issue body is built from untrusted email content and sender identity verbatim, which can expose secrets, personal data, or internal details in a public or broadly accessible repository. Because the workflow is automatic, a malicious sender could intentionally cause sensitive disclosure or reputational damage by emailing crafted content.

External Transmission

Medium
Category
Data Exfiltration
Content
'labels': labels
    }
    
    response = requests.post(
        f'https://api.github.com/repos/{repo}/issues',
        json=issue_data,
        headers={
Confidence
86% confidence
Finding
requests.post( f'https://api.github.com/repos/{repo}/issues', json=

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: agentmail
description: API-first email platform designed for AI agents. Create and manage dedicated email inboxes, send and receive emails programmatically, and handle email-based workflows with webhooks and real-time events. Use when you need to set up agent email identity, send emails from agents, handle incoming email workflows, or replace traditional email providers like Gmail with agent-friendly infrastructure.
---

# AgentMail
Confidence
78% confidence
Finding
Create and manage dedicated email inboxes, send and receive emails programmatically, and handle email-based workflows with webhooks and real-time events. Use when you need to set up agent email identi

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:89