ClawHub
Back to skill

Security audit

lobsterMail.ai - instant email for your agent

Security checks for vulnerabilities and agentic risk

Overview

This skill provides real third-party email inboxes and outbound sending, but its instructions are too broad and do not clearly require user approval for sensitive external actions.

Review before installing. Use this only when you intend an agent to create and manage real lobstermail.ai inboxes and possibly send real email. Avoid personal, regulated, confidential, or high-value account flows unless you are comfortable with the service handling the email content and metadata. Require explicit approval before account signups, verification-code handling, inbox monitoring, billing or card verification, and every outbound email.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding

Unreviewed Third-Party npm Package Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:6 and SKILL.md:21-27
Vulnerability Type: Third-party supply-chain exposure through runtime package retrieval and execution
Risk Level: Medium

Vulnerable Code

yaml
metadata: {"openclaw": {"emoji": "🦞", "requires": {"anyBins": ["npx"]}, "install": [{"id": "mcp", "kind": "mcp", "command": "npx lobstermail-mcp@1.4.0", "label": "Add LobsterMail MCP Server"}]}}
json
{
  "mcpServers": {
    "lobstermail": {
      "command": "npx",
      "args": ["lobstermail-mcp@1.4.0"]
    }
  }
}

Technical Analysis

The Skill instructs the host to execute lobstermail-mcp@1.4.0 directly through npx. The source code of that package and its transitive dependencies is not included in the audited project, so its behavior could not be reviewed as part of this audit.

Pinning the top-level package to version 1.4.0 reduces accidental version drift, but it does not fully secure the dependency chain. The configuration does not specify or verify a package integrity digest, lock transitive dependency versions, disable npm lifecycle scripts, or establish package provenance. During package resolution and startup, npm package code and potentially lifecycle scripts execute with the permissions of the process launching npx.

This creates a supply-chain trust boundary: compromise of the npm publisher account, registry delivery path, published artifact, or a transitive dependency could cause attacker-controlled code to run locally. The repository does not contain evidence that the named package is currently malicious; the finding concerns the unsafe trust and execution model.

Attack Path

  1. An attacker compromises the package publisher, a relevant transitive dependency, or the package distribution channel.
  2. A malicious artifact or dependency is served for the package version resolved by npx.
  3. A user installs or invokes the Skill using the docu ...[truncated 1081 chars]
Remediation
View remediation

Remediation Suggestions

  1. Vendor or otherwise include the MCP server implementation and its dependency manifest in the review scope so the executed code can be audited.
  2. Generate and enforce a lockfile that pins the complete transitive dependency graph.
  3. Verify package integrity using trusted checksums and npm provenance or signatures before execution.
  4. Prefer a controlled installation step over runtime retrieval through npx, and execute only a previously verified local artifact.
  5. Disable npm lifecycle scripts during installation where the package does not require them, then explicitly review any scripts that must remain enabled.
  6. Run the MCP server in a sandbox or container with a read-only filesystem where practical, a minimal environment, restricted outbound network access, and no unnecessary host credentials.
  7. Execute the server under a dedicated, unprivileged account and expose only the files and network destinations required for LobsterMail operation.
  8. Continuously monitor the package, publisher, and dependency graph for ownership changes, advisories, unexpected artifact changes, and newly introduced lifecycle scripts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README explicitly encourages creating real email inboxes, receiving messages, and using them for account sign-up and verification, but it provides no disclosure about retention, visibility, or handling of email contents and metadata. In a skill that processes real inbound and outbound email through a third-party service, this omission can lead users to expose sensitive personal or account data without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The introductory description promotes seamless use of real inboxes and sending email, but it does not clearly warn that user data and message contents may be transmitted to a third-party service and external correspondents. This omission increases the risk of users or agents treating the tool as local-only infrastructure and disclosing sensitive information without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md
Email for AI agents. Create real `@lobstermail.ai` inboxes, receive email in real-time, and send email. No API keys, no human signup, no configuration.

**Full docs:** `https://api.lobstermail.ai/v1/docs/guides`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
Email for AI agents. Create real `@lobstermail.ai` inboxes, receive email in real-time, and send email. No API keys, no human signup, no configuration.

**Full docs:** `https://api.lobstermail.ai/v1/docs/guides`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
Email for AI agents. Create real `@lobstermail.ai` inboxes, receive email in real-time, and send email. No API keys, no human signup, no configuration.

**Full docs:** `https://api.lobstermail.ai/v1/docs/guides`

---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill’s trigger conditions are broad enough that an agent may invoke it for general email-related tasks without clearly surfacing that it will create or use real third-party inboxes. In an autonomous agent context, this can lead to unintended account registrations, receipt of sensitive messages, or data flowing to an external email service when the user did not explicitly consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The sending section explains how to send mail but does not explicitly emphasize that send_email transmits real outbound email to external recipients. In an agent setting, this can cause accidental external communications, spam/phishing-like behavior, disclosure of confidential information, or reputational harm if messages are sent without clear user approval.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.