T09 · Insecure Skill Coding Practices
Error
- Location
cli.js:20- Finding
IMAP TLS Certificate Validation Is Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
IMAP Mailbox
Security checks for vulnerabilities and agentic risk
Overview
This IMAP email skill is purpose-aligned overall, but it handles mailbox credentials and email-derived files in ways that need review before installation.
Review this skill before installing. It needs your IMAP credentials and can read mailbox contents, which fits its purpose, but it currently disables TLS certificate verification, saves email-derived digests into OpenClaw memory, and can write attachment files using unsafe sender-provided names. Install only if you trust the environment and preferably after fixing TLS verification, attachment filename sanitization, storage locations, and dependency sources.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
download-attachments.js:39- Finding
Email Attachment Filename Allows Path Traversal and Arbitrary File Overwrite
- Content
View full analysis
{ const filename = att.filename || `attachment_${i}`; const filePath = path.join(outputDir, filename); fs.writeFileSync(filePath, att.content); console.log(`Saved: ${filename} (${att.content.byteLength} bytes) -> ${filePath}`); }); ``` ### Technical Analysis The filename in a MIME attachment is controlled by the email sender. The implementation passes `att.filename` directly to `path.join` without removing directory separators, rejecting traversal components, resolving the final path, or checking that the destination remains inside `outputDir`. A filename containing components such as `../../` can escape the intended `~/.openclaw/workspace/memory/patent-attachments` directory. `fs.writeFileSync` also overwrites an existing target by default. The vulnerability is triggered when a user downloads attachments from an attacker-crafted message. Exploitation is limited to paths writable by the operating-system account running the Skill, but that scope may include Agent state, user configuration, scripts, and other user-owned files. ### Attack Path 1. An attacker sends the victim an email containing an attachment with a filename such as `../../target-file`. 2. The victim invokes the attachment-download script for the malicious email UID. 3. `mailparser` exposes the attacker-controlled MIME filename as `att.filename`. 4. `path.join(outputDir, filename)` normalizes the traversal components and constructs a path outside the intended attachment directory. 5. `fs.writeFileSync` writes attacker-controlled attachment bytes to the resulting path. 6. If the target exists and is writable, it is overwritten. If the selected target is later interpreted as configuration, memory, or executable content, furthe ...[truncated 680 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
cli.js:203- Finding
Attacker-Controlled Email Metadata Is Persisted in Agent Memory
- Content
View full analysis
{ digest += `### ${i + 1}. ${email.subject}\n`; digest += `- **发件人:** ${email.from}\n`; digest += `- **日期:** ${email.date}\n`; digest += `- **UID:** \`${email.uid}\`\n\n`; }); digest += `\n---\n💡 查看完整邮件: \`imap-mailbox read \`\n`; // 保存到文件 const digestDir = path.join(process.env.HOME, '.openclaw', 'workspace', 'memory', 'email-digests'); if (!fs.existsSync(digestDir)) { fs.mkdirSync(digestDir, { recursive: true }); } const fileName = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}-${String(now.getHours()).padStart(2, '0')}${String(now.getMinutes()).padStart(2, '0')}.md`; const filePath = path.join(digestDir, fileName); fs.writeFileSync(filePath, digest); ``` ### Technical Analysis Email sender and subject fields are controlled by remote email senders. The digest function embeds those fields directly into Markdown and persists the result beneath `.openclaw/workspace/memory/email-digests`. No trust boundary, escaping, structural encoding, or instruction/data separation is applied. A malicious sender can therefore place prompt-like instructions or crafted Markdown in persistent Agent memory. If a later Agent session loads these files as contextual memory and treats their contents as instructions rather than untrusted mailbox data, the attacker-controlled text may ...[truncated 1752 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package-lock.json:21- Finding
Dependency Lockfile Uses an Unencrypted Third-Party Package Mirror
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The documented behavior does not fully match the detected behavior: the skill apparently writes local state and digest files that are not disclosed, while a declared attachment-download feature is not actually represented in the supplied implementation. Behavior mismatches are dangerous because they undermine user and reviewer expectations, making it easier to hide persistence, sensitive data retention, or other side effects involving email content.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The IMAP client disables TLS certificate validation via rejectUnauthorized: false while sending mailbox credentials from local config. This enables man-in-the-middle attacks in which an attacker can impersonate the mail server, capture credentials, and read or alter mailbox traffic; in an email-management skill, that is especially dangerous because it exposes both authentication secrets and sensitive message content.
- Content
Known Vulnerable Dependency: linkify-it==5.0.0 — 2 advisory(ies): CVE-2026-48801 (LinkifyIt#match scan loop has quadratic algorithmic complexity); CVE-2026-59887 (linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on at)
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
linkify-it 5.0.0 is flagged with quadratic-complexity denial-of-service issues. In this skill, parsing attacker-controlled email bodies is a core function, so a crafted message containing pathological input could consume excessive CPU during text/link processing and degrade or block mailbox handling.
- Content
Known Vulnerable Dependency: nodemailer==8.0.2 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
nodemailer 8.0.2 has multiple published advisories, including header injection and resource-consumption issues. Even if only present transitively, its inclusion is especially concerning here because the skill processes untrusted email-derived content and the package provides outbound mail functionality that is outside the stated IMAP-focused purpose.
- Content
Known Vulnerable Dependency: semver==5.3.0 — 1 advisory(ies): CVE-2022-25883 (semver vulnerable to Regular Expression Denial of Service)
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
semver 5.3.0 is affected by a regular-expression denial-of-service vulnerability. Although this appears to be a transitive dependency under utf7 and may not be directly exposed, vulnerable utility libraries still increase risk if attacker-influenced version strings or package metadata are ever parsed during runtime or auxiliary operations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares capabilities that inherently require network access and likely access to local configuration, but it does not explicitly scope or constrain those tools via permissions or allowed-tools metadata. In an email-reading skill, missing scope increases the chance of overbroad execution, unintended data access, or silent expansion of what the agent may do with mailbox contents and local secrets.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Broad trigger phrases such as checking email or reading inbox can overlap with ordinary conversation, increasing the risk of accidental activation. In the context of a mailbox skill, unintended activation could expose email metadata, fetch message contents, or initiate network actions without sufficiently clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI emits Chinese-only messages and later formats dates with the zh-CN locale, indicating a fixed language/locale behavior. There is no opt-in, language selection mechanism, or documentation showing that the skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The digest operation saves sender, subject, date, and UID information from emails into markdown files under the user's home directory. While it logs the save path after writing, the code does not provide prior disclosure in comments, help text, or a prompt that mailbox contents will be stored locally.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code exposes a 'setup' command and earlier error text instructs users to run 'imap-mailbox setup' when the config file is missing. However, setupConfig only prints '配置已存在' and does not create, validate, or update configuration, which directly contradicts the documented/advertised intent of the setup flow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes an IMAP mailbox skill for reading and managing email, but this file directly accesses ~/.config/imap-mailbox/config.json to load account credentials. While IMAP access itself is expected, reading arbitrary local files from the home directory is a separate local-file access capability that is not justified or declared by the stated skill purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code loads mailbox configuration, including credentials, from a user-specific config file and uses them to access an email account. While the script's purpose implies email access, there is no comment, docstring, or explicit user-facing disclosure that sensitive credentials are being read from disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes downloaded attachments and email text directly to disk in a persistent workspace path without confirmation, sanitization, or minimization. This can expose sensitive documents and message content to other local components, and attacker-controlled attachment filenames may cause unsafe writes within the target tree.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script is named and described as an attachment downloader, but it also exports the full email body text to a workspace file. That broadens data collection beyond the apparent feature scope and can persist sensitive message content, increasing the risk of unintended disclosure to other tools, users, or processes with access to the workspace.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The lockfile includes nodemailer as a transitive dependency even though the skill is described as IMAP mailbox reading/management, not outbound mail sending. Extra outbound-capable mail functionality expands the attack surface and can enable unintended data exfiltration or misuse if exposed through code paths or future changes, especially in an email-processing skill handling sensitive content.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The use-case section describes when the skill may be used but does not clearly define when it should not activate, leaving room for ambiguous routing decisions. For an email-access skill, that ambiguity can result in unintentional mailbox operations or disclosure of sensitive message summaries when the user was only speaking generally about email.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest describes an IMAP mailbox skill for listing, reading, searching, downloading attachments, and digest mode. While digest mode is declared, this implementation also stores mailbox-tracking state and generated digest content under ~/.openclaw/workspace/memory, which extends behavior from transient mailbox operations into local persistence of email metadata and summaries.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The code explicitly formats dates using toLocaleDateString('zh-CN'), which imposes a Chinese locale regardless of the user's preferences or system settings. This is a natural-language/locale policy concern because the tool does not offer a choice or explain the restriction.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency uses a caret version range, which allows npm to install newer compatible releases rather than an exact reviewed version. This increases supply-chain risk because a future upstream compromise, malicious publish, or breaking security change could be pulled into the skill without explicit maintainer review.
- Content
json "imap-mailbox": "./cli.js" }, "dependencies": { "html-to-text": "^9.0.5", "imap": "^0.8.19", "mailparser": "^3.6.5", "minimist": "^1.2.8"
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The imap package is specified with a caret range, so builds may resolve to different upstream versions over time. For a mail-handling skill that processes credentials and network data, this creates avoidable supply-chain exposure if an unreviewed release introduces malicious code or a vulnerable behavior.
- Content
json }, "dependencies": { "html-to-text": "^9.0.5", "imap": "^0.8.19", "mailparser": "^3.6.5", "minimist": "^1.2.8" }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The mailparser dependency is not strictly pinned, allowing automatic adoption of later semver-compatible releases. Because this skill parses attacker-controlled email content, pulling in unreviewed parser changes raises supply-chain and parser-security risk beyond a typical utility package.
- Content
json "dependencies": { "html-to-text": "^9.0.5", "imap": "^0.8.19", "mailparser": "^3.6.5", "minimist": "^1.2.8" } }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The minimist dependency is referenced with a caret range instead of an exact version, permitting drift across installations. While the direct impact is usually limited, it still widens the attack surface for dependency confusion, compromised maintainer releases, or introduction of known vulnerable subversions.
- Content
json "html-to-text": "^9.0.5", "imap": "^0.8.19", "mailparser": "^3.6.5", "minimist": "^1.2.8" } }