Custom Smtp Sender

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:15 AM UTC
• Version: 1.0.0

Overview

This email-sending skill does what it claims at a basic level, but it uses stored SMTP credentials and can transmit local files with weak scoping and a possible plaintext SMTP path.

Install only if you trust the publisher and are comfortable with this skill using the SMTP account in /home/bb/.openclaw/smtp-config.json to send email and attachments. Use a dedicated app password, keep useTLS true, avoid attaching sensitive files, and treat the advertised markdown, retry, and logging claims as not implemented in the inspected code.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: email_sender.py:19

Finding

SMTP Authentication and Email Transmission May Occur Without Transport Encryption

Content

View full analysis

Vulnerability Details

File Location: email_sender.py, lines 19–20
Vulnerability Type: Conditional plaintext transmission of SMTP credentials and email contents
Risk Level: High

Complete Code Snippet:

python

server = smtplib.SMTP_SSL(config['server'], config['port']) if config.get('useTLS') else smtplib.SMTP(config['server'], config['port'])
server.login(config['username'], config['password'])

Technical Analysis

The SMTP connection is encrypted only when the useTLS configuration value evaluates to true. If that setting is false, missing, or otherwise falsey, the code creates a plaintext smtplib.SMTP connection and immediately calls server.login() without first negotiating STARTTLS.

As a result, SMTP authentication credentials and subsequently transmitted message data may be exposed over the network. Although some authentication mechanisms encode credentials, encoding does not provide confidentiality. The implementation also does not create an explicit verified TLS context or reject configurations that disable transport encryption.

Attack Path

1. The SMTP configuration omits useTLS or sets it to false.
2. The skill opens a plaintext SMTP connection using smtplib.SMTP.
3. It authenticates through server.login() without calling starttls().
4. An attacker with a network position between the host and SMTP server captures or manipulates the SMTP traffic.
5. The attacker may recover SMTP credentials and observe email bodies or attachments.
6. Stolen credentials may then be used against the SMTP service within the permissions assigned to that account.

Impact Assessment

A successful network interception may disclose the configured SMTP username and password, email recipients, subjects, message contents, and attachments. Depending on the SMTP account's permissions, stolen credentials could permit unauthorized email transmission, impersonation of the configured sender, sp ...[truncated 268 chars]

Remediation

View remediation

Remediation Suggestions

• Require encrypted SMTP transport rather than silently falling back to plaintext.
• For implicit TLS, use smtplib.SMTP_SSL with ssl.create_default_context().
• For explicit TLS, connect with smtplib.SMTP, issue EHLO, call starttls(context=ssl.create_default_context()), issue EHLO again, and only then call login().
• Reject missing or false TLS settings by default. If plaintext SMTP must be supported for an exceptional local environment, require an explicit insecure opt-in and display a prominent warning.
• Validate the SMTP hostname and rely on certificate verification provided by a secure default SSL context.
• Use a context manager or try/finally block to ensure the SMTP connection is closed safely on authentication, attachment-processing, or transmission failures.
• Protect the configuration file with restrictive permissions and use a dedicated, least-privileged SMTP credential that is not reused by other services.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The primary purpose matches: this is an email-sending utility that uses the declared SMTP configuration path and supports HTML/text bodies and attachments. However, the declared description overstates several concrete capabilities. There is no implementation for markdown support, no retry mechanism around SMTP connection or sending, and no logging. These are material description-to-behavior mismatches, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents access to a local SMTP credential file at /home/bb/.openclaw/smtp-config.json but does not declare any tool scope or permissions. In an agent environment, undeclared file-read capability reduces transparency and can enable unauthorized access to sensitive credentials if the runtime permits implicit reads.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

}

text

Ensure file permissions are secured (chmod 600).

## Usage
Send a basic email:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill silently loads SMTP credentials from a fixed local path and immediately uses them to authenticate to an external mail server, with no confirmation, disclosure, or permission boundary. In an agent/tooling context, this is dangerous because invoking the skill can cause unintended use of stored secrets and unauthorized outbound email activity under the user's identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill can read arbitrary local files for the message body and attachments and transmit their contents externally via email without any user-facing warning at send time. In an agent environment, this materially increases exfiltration risk because sensitive local data can be attached and sent off-host through an already-configured SMTP account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.