Greek Email Processor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:05 PM UTC
• Version: 0.1.1

Overview

This skill needs review because it can access sensitive accounting email and gives inconsistent guidance about automatic replies, mailbox permissions, and external integrations.

Install only after confirming the mailbox scopes, account boundaries, and outbound-message controls. Use a dedicated service mailbox, prefer read-only IMAP for monitoring, disable SMTP/Mail.Send/Mail.ReadWrite unless explicitly needed, require human review before any email is sent or any attachment is forwarded, and document where email content or summaries may leave your environment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:114

Finding

Excessive Microsoft Graph Mailbox Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 114-119
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

microsoft_graph_scopes:
  - "https://graph.microsoft.com/Mail.Read"
  - "https://graph.microsoft.com/Mail.Send"
  - "https://graph.microsoft.com/Mail.ReadWrite"

Technical Analysis

The documented Microsoft Graph configuration requests Mail.ReadWrite together with Mail.Read and Mail.Send. Mail.ReadWrite authorizes mailbox modifications even though the setup guidance recommends read-only access and the primary classification workflow only requires reading messages.

Granting read, write, and send capabilities to one automated Agent unnecessarily expands the trust boundary. If the Agent misclassifies a request, processes adversarial email content, or invokes an unsafe workflow, it could modify mailbox contents and communicate externally using the configured account.

Attack Path

1. An operator authorizes the Skill with the documented Microsoft Graph scopes.
2. An attacker sends a crafted email designed to match a supported processing workflow.
3. The Agent reads and interprets the attacker-controlled message.
4. The message influences an automated action or triggers erroneous processing.
5. Because the Agent has Mail.ReadWrite and Mail.Send, the resulting action can modify mailbox data or send a message as the configured user.

Impact Assessment

A compromised or incorrectly directed workflow could:

• Read sensitive business and financial correspondence.
• Mark, move, or otherwise modify messages.
• Potentially remove messages where the granted API operations permit it.
• Send email using the configured mailbox identity.
• Conceal or disrupt accounting and compliance communications.
• Expose payment, client, invoice, or government-notification information.

The affected scope is the mailbox and operations covered by the OAuth grant. Th ...[truncated 96 chars]

Remediation

View remediation

Remediation Suggestions

• Use Mail.Read as the default scope for monitoring and classification.
• Remove Mail.ReadWrite unless a specific, documented feature cannot function without it.
• Request Mail.Send only when outbound email is explicitly enabled.
• Separate read-only processing from privileged mailbox modification and sending.
• Require separate, informed consent before enabling each privileged operation.
• Prefer delegated permissions scoped to a dedicated service mailbox rather than broad application permissions.
• Add server-side policy restrictions governing permitted recipients, folders, and message operations.
• Record all mailbox mutations and outbound messages in an immutable audit log.
• Require human approval for message deletion, movement, forwarding, and sending.
• Periodically review and revoke unused OAuth grants.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:305

Finding

Auto-Response Workflows Bypass the Documented Human-Approval Requirement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 305, 325-326, and 621; conflicting safe example at line 655
Vulnerability Type: Unsafe external communication and inconsistent approval enforcement
Risk Level: Medium

Vulnerable Code

bash

# Process client communications
openclaw email process --filter "client-communications" --auto-respond

bash

# Auto-respond to routine requests
openclaw email auto-respond --filter "routine" --use-greek-templates

bash

$ openclaw email process --filter "client-communications" --auto-respond

The above commands conflict with the separately documented safe behavior:

bash

openclaw email generate-responses --templates-greek --auto-send false

They also conflict with the metadata declaration that all automatic responses require human approval.

Technical Analysis

Several operational examples enable --auto-respond without an explicit draft-only setting or approval gate. Only a later, separate example uses --auto-send false. Consequently, an Agent following the daily workflow or usage examples may send responses directly rather than preparing drafts for review.

Incoming email is attacker-controlled input. Response workflows may query accounting systems, inspect payment status, attach receipts, or incorporate client records. Allowing attacker-controlled messages to trigger outbound communication without review creates a confused-deputy risk and can disclose sensitive information or send inaccurate business commitments.

Documentation stating that approval is required is insufficient when the executable workflow examples omit the enforcement mechanism.

Attack Path

1. An attacker sends an email matching a routine, payment-inquiry, document-request, or client-communication filter.
2. The monitoring workflow classifies the email as eligible for automatic response.
3. The Agent queries internal accounting or client records and populates a response template.
4. The docume ...[truncated 969 chars]

Remediation

View remediation

Remediation Suggestions

• Replace every --auto-respond example with draft-only generation.
• Apply --auto-send false consistently to all response-generation workflows.
• Require an explicit, authenticated human approval action before SMTP or Graph transmission.
• Display recipients, subject, body, attachments, and data sources to the reviewer.
• Never attach financial documents solely because an incoming message requests them.
• Verify sender identity and authorization independently of the visible From address.
• Add recipient allowlists and client-to-address mappings for sensitive responses.
• Require stronger approval for messages containing payment information or attachments.
• Prevent email body content from changing approval settings, recipients, or attachment selection.
• Maintain immutable logs recording the generated draft, approving identity, final content, recipients, and transmission result.
• Add automated tests that fail if a sending workflow lacks an approval token or draft-only flag.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:559

Finding

Misleading Local-Only Claim Conceals Documented External Trust Boundaries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 559, in conflict with external integration metadata at line 8 and Microsoft Graph scopes at lines 114-119
Vulnerability Type: Inaccurate security boundary documentation
Risk Level: Low

Vulnerable Code

markdown

> **Note**: This skill does NOT integrate with external software. It processes emails and routes extracted data to companion OpenClaw skills via the local filesystem.

The project metadata separately documents external services:

yaml

SMTP_HOST: "Email server for auto-responses (requires human approval before sending)"
GOOGLE_CLIENT_ID: "Gmail API OAuth client ID (alternative to IMAP for Gmail users)"
GOOGLE_CLIENT_SECRET: "Gmail API OAuth client secret"
MS_CLIENT_ID: "Microsoft Graph API client ID (alternative to IMAP for Outlook users)"
MS_CLIENT_SECRET: "Microsoft Graph API client secret"
GOOGLE_CALENDAR_ID: "Google Calendar ID for deadline event creation"
SLACK_WEBHOOK_URL: "Webhook URL for processing status notifications"

Microsoft Graph integration is also explicitly documented:

yaml

microsoft_graph_scopes:
  - "https://graph.microsoft.com/Mail.Read"
  - "https://graph.microsoft.com/Mail.Send"
  - "https://graph.microsoft.com/Mail.ReadWrite"

Technical Analysis

The assertion that the Skill does not integrate with external software is inconsistent with its documented SMTP, IMAP, Slack webhook, Google Calendar, Gmail API, and Microsoft Graph capabilities.

This inaccurate statement can cause operators to misunderstand where sensitive email and accounting information may be transmitted. It can also undermine security review, privacy assessment, endpoint allowlisting, credential governance, and informed consent. While the statement does not itself execute a malicious action, it weakens deployment security by concealing or minimizing material trust boundaries.

Attack Path

1. An operator reviews the local-only statement and assumes processing remai ...[truncated 1074 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the statement that the Skill does not integrate with external software.
• Provide a complete inventory of every external service and protocol.
• Document the data fields transmitted to each service.
• Identify required credentials, OAuth scopes, endpoints, retention behavior, and subprocessors.
• Make every external integration opt-in and disabled by default.
• Require explicit consent before sending email content, attachments, client data, or processing summaries externally.
• Add endpoint allowlisting and TLS certificate validation requirements.
• Minimize Slack and calendar notifications so they do not contain unnecessary financial or personal data.
• Provide deployment guidance for secret storage, credential rotation, revocation, and audit logging.
• Clearly distinguish local companion-Skill routing from external API, email, calendar, and webhook communication.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow describes automatic responses and forwarding of business emails and attachments to accounting systems, but provides no warning or consent mechanism about privacy, external transmission, or the consequences of acting automatically. In an accounting context, this can expose invoices, tax documents, and client correspondence to unauthorized systems or trigger misleading replies without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The monitoring configuration covers email-account integration and sensitive financial communications, yet it omits any notice about account access, handling of regulated or confidential data, or automation side effects. This is dangerous because users may grant broad mailbox permissions and enable unattended processing without understanding privacy, compliance, or misrouting risks.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

export SMTP_PASSWORD="app-specific-password"

# 4. Ensure dependencies are installed
which jq curl || sudo apt install jq curl

# 5. Create incoming directories
mkdir -p $OPENCLAW_DATA_DIR/incoming/{invoices,receipts,statements,government}

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The prompt authorizes processing of all incoming Greek business emails from the last 24 hours with automatic detection, response, and forwarding, but it does not define sender allowlists, folder scope, message classes, or exclusion rules. In a financial-email workflow, this can cause overcollection, unintended handling of sensitive messages, and unsafe automation on phishing or irrelevant emails.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt explicitly requires sending Greek responses, which imposes a fixed language behavior. The file does not offer user opt-in, fallback language choice, or a documented justification that the skill is intentionally limited to a Greek-only locale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup request enables ongoing automated monitoring across Gmail and Outlook for invoices, bank statements, and government notifications without clearly limiting what messages may be accessed or what conditions trigger action. Because these accounts contain sensitive financial and regulatory communications, broad monitoring expands attack surface and increases the chance of unauthorized or mistaken processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The prompt requires 'Greek language templates for automatic responses,' which enforces a specific language choice. No language preference mechanism or explicit region-specific policy justification is provided in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description and embedded template content require professional Greek business communication and provide only Greek-language templates. This creates a fixed locale behavior without evidence of user choice or a clearly documented regional-only constraint.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The setup instructions tell users to run 'sudo apt install jq curl' directly from the skill documentation. Encouraging privileged package installation as part of skill setup expands the trust boundary and can normalize running environment-preparation commands with elevated rights, which is risky in adversarial or poorly controlled deployment contexts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

export SMTP_PASSWORD="app-specific-password"

# 4. Ensure dependencies are installed
which jq curl || sudo apt install jq curl

# 5. Create incoming directories
mkdir -p $OPENCLAW_DATA_DIR/incoming/{invoices,receipts,statements,government}

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document promises that all auto-responses require human approval, but later examples describe automated sending and auto-respond behavior without any enforced review step. In an email-processing skill handling financial and client data, this inconsistency can lead to unauthorized or premature outbound messages containing sensitive information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown explicitly prioritizes Greek as the default language policy for the skill. Because the file does not indicate any user opt-in or language-selection mechanism, this appears to force a specific language/locale, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill describes automated client notifications and responses based on email-derived content, but does not consistently foreground the privacy risks of transmitting potentially sensitive accounting, tax, or payment data. In this context, incomplete warnings can lead users to deploy automation that leaks client information or sends incorrect financial details externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The workflow templates show automatic extraction, forwarding, and processing of attachments and client/accounting data without clear user-facing cautions about sensitivity, retention, or downstream disclosure. Because this skill handles invoices, bank statements, and government notices, silent forwarding materially increases the risk of privacy violations and inappropriate propagation of sensitive documents.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file claims the skill does not integrate with external software, but elsewhere it explicitly documents IMAP/SMTP, Gmail API, Microsoft Graph, Slack webhook, and calendar connectivity. This kind of contradictory security documentation can mislead operators about the network and data-exposure surface, causing them to enable the skill under false assumptions about external data flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This prompt specifies that the email is in Greek and asks for a response workflow around that language context. While region-specific content may be reasonable, the file does not explicitly document that this skill is intentionally constrained to Greek/Greek-regulatory use cases.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.