ClawHub
Back to skill

Security audit

SentVia Email

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real email integration, but it needs review because it can create a live inbox and send, reply, forward, or block email without explicit user-confirmation safeguards.

Install only if you want the agent to operate a real SentVia email address. Before use, require the agent to show recipients, message text, forwarding targets, and sender-blocking changes for approval, and do not allow it to email secrets, credentials, private workspace data, or unreviewed content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
77% confidence
Finding
The skill is described broadly as giving the agent its own email address and enabling inbox creation, sending, replying, searching, and sender management, but it does not define narrow activation boundaries or require explicit user confirmation before performing high-impact actions. In practice, this can cause an agent to invoke the skill in contexts where the user did not intend real-world email actions, increasing the risk of unintended external communication.

Missing User Warnings

High
Confidence
94% confidence
Finding
The skill explicitly enables sending and receiving real email and creating live inboxes, but it does not present a clear upfront warning to the user that actions have real external effects. This omission is dangerous because an agent may send messages, create identities, or interact with external parties without the operator appreciating the real-world consequences.

External Transmission

Medium
Category
Data Exfiltration
Content
tools (`create_inbox`, `send_message`, `reply_to_message`, `search_messages`, …)
over raw HTTP. To set it up:
`openclaw mcp add sentvia --command npx --arg -y --arg sentvia-mcp` and put
`SENTVIA_API_KEY` in that server's `env`. Otherwise use curl as below.

## Your address
Confidence
90% confidence
Finding
This section instructs the agent to create and reuse a live inbox and to interact with an external email API, enabling persistent external communications. Although this is core functionality rather than overtly malicious behavior, it is security-relevant because it expands the agent's ability to exfiltrate information, contact third parties, and establish durable external channels if invoked incorrectly or through prompt injection elsewhere.

External Transmission

Medium
Category
Data Exfiltration
Content
---

You can send and receive real email through SentVia. Your API key is in
`SENTVIA_API_KEY`; all requests go to `https://api.sentvia.ai/v1` with
`Authorization: Bearer $SENTVIA_API_KEY` and JSON bodies.

If the SentVia MCP server is configured (`sentvia` in `mcp.servers`), prefer its
Confidence
87% confidence
Finding
The skill normalizes direct authenticated communication with an external API using a bearer token from environment variables. Even though it does not explicitly tell the agent to reveal the token, this creates a clear external transmission pathway and increases the blast radius of any downstream prompt-injection or data-handling mistake, especially because the service can send real email.

Static analysis

No suspicious patterns detected.