Zoho Mail CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:39 PM UTC
• Version: 0.1.4

Overview

This Zoho Mail skill is coherent, but it asks users to install an unpinned third-party mail CLI that handles OAuth tokens and also documents irreversible mail deletion without enough safety guidance.

Review the upstream zoho-cli source and installation path before installing. Prefer a pinned release or commit with integrity verification, and be careful granting OAuth access because the tool can read, send, download, move, and delete mail. Avoid using permanent delete or folder delete through automation unless you have independently confirmed exactly what will be affected and have recovery options.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22
• Finding: Unpinned Third-Party CLI Installation from Mutable Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 22–29 and 42–48 **Vulnerability Type**: Unpinned executable dependency from mutable Git and Homebrew sources **Risk Level**: High ### Vulnerable Code Snippet ```yaml install: - kind: brew formula: robsannaa/tap/zoho-cli bins: [zoho] - kind: uv package: git+https://github.com/robsannaa/zoho-cli bins: [zoho] - kind: pipx package: git+https://github.com/robsannaa/zoho-cli bins: [zoho] ``` The installation instructions repeat these mutable dependency references: ```bash # Homebrew (macOS / Linux) brew install robsannaa/tap/zoho-cli # uv (all platforms) uv tool install git+https://github.com/robsannaa/zoho-cli # pipx (all platforms) pipx install git+https://github.com/robsannaa/zoho-cli ``` ### Technical Analysis The skill directs users or agents to install and execute a third-party CLI from a personal Homebrew tap or directly from the default revision of a Git repository. The dependency is not constrained to a reviewed version, immutable commit hash, checksum, or cryptographically signed artifact. Consequently, the effective executable can change after this skill has been reviewed. A compromised maintainer account, repository, release process, or Homebrew tap could distribute altered code without requiring any modification to `SKILL.md`. This risk is security-sensitive because the installed CLI is instructed to process OAuth client credentials, access and refresh tokens, email contents, attachments, recipient addresses, and mailbox-management operations. The repository under audit contains only the skill documentation, so the behavior and integrity of the externally installed executable could not be verified as part of this audit. ### Attack Path 1. An attacker compromises the upstream GitHub repository, maintainer account, build pipeline, or Homebrew tap. 2. The attacker modifies the current default branch or package formula to distribute a malicious ...[truncated 1210 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Git-based installations to a reviewed, immutable commit or signed release tag rather than the repository's mutable default branch. 2. Prefer a trusted package registry that supports immutable versioned releases and package-integrity metadata. 3. Pin the Homebrew formula to a reviewed release and verify that downloaded artifacts have fixed SHA-256 checksums. 4. Publish expected artifact hashes or signature-verification instructions in the skill documentation. 5. Require cryptographic release signatures and document how users or agents must verify them before installation. 6. Use reproducible builds and a controlled release pipeline with protected branches, mandatory review, and restricted publishing credentials. 7. Periodically audit the pinned CLI source and update the dependency only through an explicit security review. 8. Apply least-privilege OAuth scopes where supported, and provide token-revocation and credential-rotation instructions for suspected dependency compromise. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents destructive actions such as permanent deletion of mail and folder deletion without prominent safety guidance, confirmation requirements, or warnings about irreversible consequences. In an agent-oriented context, these commands may be invoked programmatically from search results or automation pipelines, increasing the chance of accidental bulk data loss.

Static analysis

No suspicious patterns detected.