Security audit

Gmail IMAP

Security checks for vulnerabilities and agentic risk

Overview

The Gmail skill is mostly transparent about mailbox access, but a real identifier-handling flaw could move or trash the wrong email.

Review this skill before installing if you plan to let an agent move or trash email. Use a dedicated Google App Password, protect the environment variables, and avoid destructive commands until the script consistently uses stable IMAP UIDs and ideally confirms message metadata before moving or trashing mail.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gmail_imap.py:112
Finding: Message sequence numbers are presented as UIDs, causing operations to target the wrong email
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/gmail_imap.py:238
Finding: Email sending unnecessarily creates and leaves open an authenticated IMAP session
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation declares access to sensitive environment variables and inherently requires network connectivity to Gmail, but it does not define any explicit tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and makes it easier for an agent runtime to grant broader-than-necessary capabilities, especially in a skill that can read, send, move, and delete email.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file instructs users to set GMAIL_IMAP_USER and GMAIL_IMAP_PASSWORD, which are sensitive credentials, but it does not include any warning about protecting those values or the privacy implications of granting mailbox access. Under the markdown-file criteria for missing user warnings, credential use affecting user privacy should be disclosed clearly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.