ClawHub
Back to skill

Security audit

Custom Smtp Sender

Security checks across malware telemetry and agentic risk

Overview

This skill is an email sender, but it can use stored SMTP credentials to send arbitrary local files without built-in confirmation or path limits.

Review carefully before installing. Use a dedicated low-privilege SMTP account or app password, keep the config file restricted, and only invoke the skill after checking the exact recipient, subject, body source, and attachment paths. Do not rely on the advertised retry, logging, or markdown conversion features unless the implementation is updated.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill explicitly depends on reading `/home/bb/.openclaw/smtp-config.json`, which is a file-read capability, yet no corresponding permission is declared. Hidden or undeclared file access weakens user consent and security review, especially because the file contains sensitive SMTP credentials. In an email-sending skill, access to local credential files is security-relevant and should be transparently declared.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
If the skill supports `--body-file` or similar input to read arbitrary local files and include their contents in outbound email, that creates a direct exfiltration path that is not disclosed in the skill description. Combining local file reads with outbound SMTP transmission is particularly dangerous because an attacker or prompt injection could cause sensitive files to be emailed externally without clear user awareness. The mismatch between declared behavior and actual capability increases the likelihood of misuse evading review.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill silently loads SMTP credentials from a fixed local path and immediately uses them to authenticate to an external mail server, without any disclosure, confirmation, or consent boundary. In an agent-skill context, this creates a capability for covert outbound communication using stored secrets, which can be abused to exfiltrate data or send mail on the user's behalf.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill reads arbitrary body content and attachment files from local paths and transmits them over SMTP without any user-facing warning, review, or allowlisting. In this skill's context, that is more dangerous because its stated purpose is outbound email delivery and it can therefore be used as a ready-made data exfiltration channel for sensitive local files or generated content.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.