T08 · Insecure Dependencies
Warning
- Location
SKILL.md:48- Finding
Unpinned and Unverifiable External Package Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Agentmail Wrapper
Security checks for vulnerabilities and agentic risk
Overview
This is an email-sending and tracking skill, but it relies on unaudited external packages and presents bulk/tracking features without enough guardrails.
Review this carefully before installing. Only use it in a test or least-privilege environment until the publisher provides complete source or verified pinned packages. Confirm you have consent and legal basis before enabling open/click tracking or batch campaigns, and keep email API keys or Gmail refresh tokens in a protected secrets store with minimal scope.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
package.json:5- Finding
Declared Package Entry Point Is Missing from the Audited Artifact
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README enables click and open tracking in example usage, which affects recipient privacy and can collect behavioral data. While compliance is mentioned later, the documentation does not clearly warn users at the point of use that these options perform recipient activity tracking and may require consent or notice.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
from: 'noreply@example.com', fromName: 'My App', trackingDomain: 'email.example.com', webhookUrl: 'https://api.example.com/webhooks/mail' });
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
from: 'noreply@example.com', fromName: 'My App', trackingDomain: 'email.example.com', webhookUrl: 'https://api.example.com/webhooks/mail' });
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The README shows automated sequence sending and batch promotional email delivery, which can affect many recipients and may be difficult to reverse once queued or sent. The examples present these operations as straightforward usage without a clear caution about reviewing recipient lists, consent, and the irreversible nature of sent emails.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly promotes email sending, delivery tracking, open/click tracking, and reply tracking, but provides no user-facing warning about privacy implications, consent requirements, or the data collection involved. In an agent skill context, this increases the risk that an autonomous system could enable tracking or bulk messaging without operators clearly understanding compliance, consent, and surveillance implications.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example correctly uses an environment variable instead of hardcoding a secret, but it omits any guidance on secure credential storage, scoping, rotation, and avoiding accidental logging or exposure. In isolation this is a low-severity documentation weakness rather than a direct exploit, but agent users may copy the example into insecure deployments without understanding secret-handling requirements.
- Content
Static analysis
No suspicious patterns detected.