Security audit

Agentmail Wrapper

Security checks for vulnerabilities and agentic risk

Overview

This is an email-sending and tracking skill, but it relies on unaudited external packages and presents bulk/tracking features without enough guardrails.

Review this carefully before installing. Only use it in a test or least-privilege environment until the publisher provides complete source or verified pinned packages. Confirm you have consent and legal basis before enabling open/click tracking or batch campaigns, and keep email API keys or Gmail refresh tokens in a protected secrets store with minimal scope.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:48
Finding: Unpinned and Unverifiable External Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:48-52`, `README.md:21-24`, and `README.md:55-63` **Vulnerability Type**: Third-party package supply-chain exposure **Risk Level**: Medium ### Vulnerable Code `SKILL.md:48-52`: ```bash npm install agentmail-wrapper # or pip install agentmail-wrapper ``` `README.md:21-24`: ```bash npm install agentmail-wrapper # or python -m pip install agentmail-wrapper ``` `README.md:55-63`: ```markdown ### Node.js ```bash npm install agentmail-wrapper ``` ### Python ```bash pip install agentmail-wrapper ``` ``` ### Technical Analysis The documentation directs users to install packages named `agentmail-wrapper` from both the npm and PyPI registries without specifying an immutable version, integrity hash, lockfile, or verified artifact source. The audited project contains no implementation of either distribution, so the behavior of the packages retrieved by these commands cannot be verified against the advertised functionality. npm and PyPI are separate package ecosystems, and control of a name in one registry does not establish control of the same name in the other. Package installation can execute package-controlled lifecycle or build logic. For example, an npm package may define installation scripts, while a Python distribution may execute build-backend logic during installation. Consequently, compromise, replacement, dependency confusion, or mistaken ownership of either external package could expose users to arbitrary code execution under the privileges of the package-manager process. No evidence in the supplied artifact proves that either external package is currently malicious. The finding concerns the unverifiable and mutable supply-chain trust introduced by the installation instructions. ### Attack Path 1. A user trusts the skill documentation and runs one of the provided installation commands. 2. The package manager resolves the package name through an external registry. 3. Because no exact ...[truncated 1072 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the complete auditable implementation in the project artifact. 2. Pin installations to reviewed, exact package versions rather than resolving the latest mutable release. 3. Provide lockfiles and registry-generated integrity hashes for all dependencies. 4. Publish verified links to the exact npm and PyPI publisher profiles and document ownership of both package names. 5. Use package provenance or signed release attestations where supported. 6. Audit package lifecycle scripts and Python build configuration before recommending installation. 7. In CI environments, install dependencies with minimum privileges and without access to unrelated production credentials. 8. Consider disabling unnecessary lifecycle scripts during dependency review and installing only from an approved internal registry or verified mirror. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: package.json:5
Finding: Declared Package Entry Point Is Missing from the Audited Artifact<![CDATA[ ## Vulnerability Details **File Location**: `package.json:5` **Vulnerability Type**: Incomplete and unverifiable package implementation **Risk Level**: Low ### Vulnerable Code `package.json:1-6`: ```json { "name": "agentmail-wrapper", "version": "1.0.0", "description": "Verified email delivery integration. Send, track, schedule with multi-provider support (SendGrid, Mailgun, AWS SES, SMTP). GDPR/CAN-SPAM compliant.", "main": "index.js", "keywords": [ ``` The complete supplied directory contains only: ```text README.md SKILL.md package.json ``` The declared `index.js` entry point is absent. ### Technical Analysis The package manifest declares `index.js` as its executable module entry point, but that file and all other implementation source files are missing from the audited artifact. Requiring this local package would therefore fail entry-point resolution rather than provide the documented API. The missing implementation also prevents verification of security-sensitive behavior claimed by the documentation, including: - Handling of SendGrid, Mailgun, AWS SES, SMTP, and Gmail credentials. - OAuth refresh-token storage and use. - Email content processing and template interpolation. - Webhook authentication and delivery tracking. - Unsubscribe and compliance controls. - Network destinations and transmission security. This inconsistency can cause consumers to obtain a separate external package to acquire the expected implementation. That external code is outside the audited artifact and may not correspond to the documentation or manifest reviewed here. No executable malicious code was found in the supplied project. This finding concerns the absence of the declared implementation and the resulting inability to verify or safely execute the advertised package. ### Attack Path 1. A consumer reviews the documentation and assumes the artifact contains the advertised email integration. 2. The consumer installs or packages the supplied art ...[truncated 999 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Add the declared `index.js` entry point and the complete implementation to the project. 2. Include all source files required for every documented provider and feature. 3. Add automated tests that import the package and verify that the documented public API is present. 4. Add security tests for credential handling, webhook authentication, template interpolation, URL validation, and sensitive-data logging. 5. Include complete dependency declarations and an integrity-protected lockfile. 6. If the artifact is intentionally documentation-only, remove the `main` declaration and executable package claims, and clearly state that no implementation is included. 7. Ensure published registry artifacts are reproducibly built from the reviewed source and are covered by provenance attestations. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README enables click and open tracking in example usage, which affects recipient privacy and can collect behavioral data. While compliance is mentioned later, the documentation does not clearly warn users at the point of use that these options perform recipient activity tracking and may require consent or notice.

External Transmission

Medium

Category: Data Exfiltration
Content: from: 'noreply@example.com', fromName: 'My App', trackingDomain: 'email.example.com', webhookUrl: 'https://api.example.com/webhooks/mail' }); ```
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: from: 'noreply@example.com', fromName: 'My App', trackingDomain: 'email.example.com', webhookUrl: 'https://api.example.com/webhooks/mail' }); ```
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The README shows automated sequence sending and batch promotional email delivery, which can affect many recipients and may be difficult to reverse once queued or sent. The examples present these operations as straightforward usage without a clear caution about reviewing recipient lists, consent, and the irreversible nature of sent emails.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly promotes email sending, delivery tracking, open/click tracking, and reply tracking, but provides no user-facing warning about privacy implications, consent requirements, or the data collection involved. In an agent skill context, this increases the risk that an autonomous system could enable tracking or bulk messaging without operators clearly understanding compliance, consent, and surveillance implications.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The example correctly uses an environment variable instead of hardcoding a secret, but it omits any guidance on secure credential storage, scoping, rotation, and avoiding accidental logging or exposure. In isolation this is a low-severity documentation weakness rather than a direct exploit, but agent users may copy the example into insecure deployments without understanding secret-handling requirements.

Static analysis

No suspicious patterns detected.