ClawHub
Back to skill

Security audit

AgentCloak - Email Proxy that filters PII, 2FA, and password resets

Security checks for vulnerabilities and agentic risk

Overview

AgentCloak is clearly an email proxy skill, but its self-hosting setup asks users to run mutable third-party code that was not pinned to a reviewed version.

Review the hosted-service trust model before connecting an inbox, because the hosted AgentCloak server receives email credentials and message content. Prefer a pinned, reviewed release or commit if self-hosting, and run it with minimal privileges because the documented setup executes code from a mutable GitHub branch.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:49
Finding

Unpinned Remote Repository Is Retrieved and Executed Locally

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–53
Vulnerability Type: Unpinned remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
git clone https://github.com/ryanfren/AgentCloak.git
cd agentcloak
pnpm install && pnpm build && pnpm dev

Technical Analysis

The self-hosting instructions clone the mutable default branch of an external Git repository and immediately install, build, and run its contents. The instructions do not pin a reviewed commit hash or signed release and do not require integrity or signature verification.

Consequently, the code executed by a user can differ from the code that existed when this skill was audited. In addition, pnpm install may execute package lifecycle scripts, while the build and development commands execute repository-controlled scripts. These operations create a direct remote code execution channel if the upstream repository, maintainer account, release process, or dependency chain is compromised.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or a dependency referenced by the project.
  2. The attacker modifies the default branch or dependency resolution to include a malicious lifecycle, build, or development script.
  3. A user follows the documented self-hosting procedure and clones the mutable default branch.
  4. The user runs pnpm install, pnpm build, and pnpm dev.
  5. The malicious code executes with the operating-system privileges and environment access of that user.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the account performing installation. The malicious code could access files readable by that account, environment variables, email-service configuration, API keys, developer credentials, and network-accessible resources. If the commands are run by a privileged user or inside an overprivileged conta ...[truncated 221 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the cloned source to a specific, reviewed commit hash or cryptographically signed release.
  • Publish the expected commit identifier and release checksum in the setup instructions.
  • Require users to verify release signatures or checksums before installation.
  • Use a committed lockfile and install with a frozen-lockfile option to prevent silent dependency resolution changes.
  • Audit package lifecycle scripts and consider initially installing with lifecycle scripts disabled.
  • Separate retrieval, verification, installation, build, and execution into distinct documented steps.
  • Run the service as an unprivileged, dedicated account or in a hardened container with minimal filesystem, environment, and network access.
  • Establish a reproducible release process so users can verify that distributed artifacts correspond to reviewed source.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:126
Finding

Detected Prompt-Injection Content Is Still Exposed to the Agent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126–129
Vulnerability Type: Unsafe handling of untrusted prompt content
Risk Level: Medium

Vulnerable Code:

markdown
### Stage 4: Prompt injection detection

Scans for 19 known injection patterns (instruction overrides, role reassignments, system tag injections, data exfiltration attempts). Flags detected content with a `[AGENTCLOAK WARNING]` prefix so the agent knows the email may be adversarial. Does not block — lets the agent make an informed decision.

Technical Analysis

The security pipeline detects suspected prompt injection but deliberately passes the adversarial content to the agent with only a warning prefix. A textual warning is not an isolation boundary: the untrusted email and the warning are both placed in the model's context, and the model may still follow attacker-controlled instructions.

Pattern matching against a finite set of known forms also does not reliably detect paraphrased, encoded, fragmented, multilingual, or otherwise novel prompt-injection payloads. The design therefore permits both detected and undetected malicious instructions to influence the agent. This behavior weakens the stated protection against prompt-injection attacks.

Attack Path

  1. An attacker sends an email containing instructions designed to manipulate an AI agent.
  2. The email is retrieved through AgentCloak.
  3. The detector either recognizes the attack and adds a warning or fails to match the payload.
  4. In either case, the attacker-controlled instructions remain available in the agent's context.
  5. The agent treats some or all of the email as actionable instructions.
  6. The agent may create an attacker-influenced draft, disclose information already present in its context, or invoke other tools available in the surrounding agent session.

Impact Assessment

Within the documented AgentCloak interface, direct email sending, deletion, ...[truncated 514 chars]

Remediation
View remediation

Remediation Suggestions

  • Quarantine detected prompt-injection content by default rather than forwarding it verbatim.
  • Return safe metadata and a structured detection result without placing the suspected payload in the agent's instruction context.
  • Require explicit human approval before revealing quarantined content.
  • If content must be available, expose it through a separate, non-executable data channel with strict delimitation and provenance labels.
  • Treat all email content as untrusted data regardless of whether known patterns are detected.
  • Apply allowlisted, schema-constrained tool operations and require confirmation for actions influenced by email content.
  • Prevent email text from selecting tools, changing system rules, accessing unrelated messages, or requesting disclosure of contextual secrets.
  • Add adversarial tests covering obfuscation, encoding, Unicode manipulation, fragmented instructions, multilingual payloads, and indirect prompt injection.
  • Document that detection is heuristic and must not be treated as a complete security boundary.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.