T09 · Insecure Skill Coding Practices
Error
- Location
scripts/config.json:4- Finding
Plaintext Mailbox Credentials Distributed in Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Email Mail Master Rose
Security checks for vulnerabilities and agentic risk
Overview
This email skill mostly matches an email-management purpose, but it ships non-placeholder mailbox credentials and can send, read, and permanently delete email without strong scoping or confirmation.
Review before installing. The publisher should remove the packaged mailbox credentials, rotate any exposed auth codes/passwords, ship only a placeholder config example, and add explicit confirmation for sending mail and all deletion operations. Do not run this skill against any mailbox unless you have replaced the config with your own intended credentials and understand that some deletes can be permanent.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill advertises only sending, viewing, and checking mail, but also supports single, bulk, and permanent deletion. In this context, the mismatch is especially dangerous because email deletion is a high-impact destructive action that could be triggered under false assumptions about the skill's scope.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill advertises only sending, viewing, and checking mail, but also supports single, bulk, and permanent deletion. In this context, the mismatch is especially dangerous because email deletion is a high-impact destructive action that could be triggered under false assumptions about the skill's scope.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The 163 mailbox implementation uses POP3 deletion, which permanently removes messages and cannot support recovery, yet this destructive behavior is beyond the manifest's described scope. In an agent setting, undisclosed permanent deletion is especially dangerous because a normal mail-management request could lead to irreversible data loss.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The batch POP3 delete function can permanently remove multiple messages in one operation without any confirmation or preview. That magnifies the blast radius of accidental invocation or prompt manipulation, turning a single unsafe action into large-scale irreversible mailbox data loss.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script exposes a full
deletecommand, including batch and permanent deletion, even though the declared skill description only authorizes sending, receiving, and checking new mail. This creates a capability mismatch that can be abused to destroy user data unexpectedly, especially in an agent setting where users and reviewers rely on the manifest to understand what actions the skill may take.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents capabilities that read configuration, invoke scripts, and perform networked email operations, but it declares no explicit tool scope or permission boundaries. In an agent environment, this increases the risk of over-broad execution and unintended access because high-impact actions can occur without a clearly constrained manifest.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest and summary omit deletion, while the body documents normal and permanent mail deletion. This creates a security disclosure gap: operators and users may approve or invoke the skill believing it is non-destructive, when it can in fact destroy mailbox contents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger description is broad enough that ordinary requests about email could activate a skill capable of sending, reading, and deleting messages. In an agent setting, ambiguous activation criteria increase the risk of the wrong tool being selected for sensitive mailbox operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill supports high-impact operations including sending, reading, and deleting email, but does not present a unified risk warning or safety model. Without clear warnings, users may not understand that mailbox contents can be transmitted, modified, or permanently removed.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Top-level documentation frames the skill as handling send/receive tasks, but later adds destructive deletion features. Hidden or de-emphasized destructive functionality raises the chance of accidental misuse, unsafe agent planning, and inadequate review before deployment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This JSON file is a natural-language/configuration artifact, so SQP-3 applies. The mailbox options and server settings are fixed to QQ, 163, and Tencent Exmail accounts, which imposes a specific locale/provider ecosystem without any indication that users can choose alternatives or have opted into that constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code can send arbitrary email bodies and attachments immediately once invoked, without any built-in confirmation or user-visible review step. In an agent context, this creates a meaningful risk of accidental data exfiltration, misdelivery, or abuse if upstream prompting or tool invocation is manipulated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill implements destructive email deletion capabilities that are not disclosed in the stated manifest scope, which only mentions sending, receiving, and checking mail. Hidden destructive functionality increases the risk that an agent or user invokes actions they did not explicitly authorize, especially because deletion can be irreversible depending on provider behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This POP3 delete path permanently deletes a message with no confirmation barrier, despite POP3 offering no recovery semantics here. A mistaken or manipulated invocation would directly cause irreversible loss of user data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's docstrings, CLI description, help text, warnings, and runtime messages are all hard-coded in Chinese, which imposes a specific language on users. There is no option to select another language or indication that the tool is intentionally limited to a Chinese-only regional context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
文件标题、描述和命令注释均以中文呈现，未说明该技能是否仅面向中文用户，或是否允许根据用户偏好切换语言。若组织要求不得在无用户选择的情况下强制特定语言，这种默认单一语言描述可能构成自然语言策略问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
User-facing docstrings, exceptions, and status messages throughout the file are written only in Chinese, with no indication that other languages are supported or that Chinese is a justified locale requirement. This can violate language/locale policy where user opt-in or explicit locale scoping is required.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's natural-language comments are entirely in Chinese, which imposes a specific language choice without offering an alternative or documenting a justified locale constraint. This matches the policy concern for language or locale restrictions in natural-language content.
- Content