IMAP Mailbox

• Outcome: Review
• Latest audit: May 28, 2026 · 10:29 AM UTC
• Version: 1.0.1

Overview

This is a real IMAP email utility, but it needs Review because it can access private mail while weakening TLS checks and saving email data locally in under-disclosed locations.

Review carefully before installing. Use only with a low-risk mailbox or app-specific credential, avoid opening downloaded attachments directly, and prefer a revised version that verifies TLS certificates, uses HTTPS dependency sources, asks before mailbox reads/downloads, and lets you choose or disable local storage for digests, attachments, and message text.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises email access over IMAP and references a local config containing an authorization token, which implies network access and secret handling without any declared permission boundary. That mismatch is dangerous because an agent or user may invoke a capability that can access sensitive mailbox data without clear consent, review, or sandbox expectations.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The skill persists mailbox-derived state and digests under a separate workspace memory directory, creating an additional local copy of sensitive email metadata outside the expected mailbox interaction path. This increases privacy exposure because other tools, users, or processes with access to that workspace may read sender, subject, date, and UID information without the user's awareness.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script is labeled and described as downloading attachments, but it also writes the full email body to local storage. That expands data collection beyond the apparent purpose and can expose sensitive message contents such as personal data, credentials, or business information to other local processes or users.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Writing email-derived data into a hard-coded '.openclaw/workspace/memory/patent-attachments' directory is unrelated to normal IMAP mailbox functionality and suggests routing data into another subsystem's working memory. In this context, that increases the risk of covert exfiltration, cross-tool data exposure, or unauthorized downstream use of mailbox contents.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases like 'check email', 'read inbox', 'new mail', and 'email digest' are broad enough to overlap with normal conversation, increasing the chance of accidental activation. For a mailbox skill, unintended invocation can expose private email metadata or content and may trigger sensitive actions such as attachment downloads.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The use-case section describes activation conditions in very general language, such as when a user asks to check email or view inbox, without defining clear boundaries for when the skill should engage. In a privacy-sensitive context like email, ambiguous routing can lead to unintentional mailbox access, disclosure of sender/subject data, or overbroad handling of user requests.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This skill handles highly sensitive content—emails, message bodies, and attachments—but the description does not prominently warn users about privacy risks, stored credentials, or the consequences of downloading potentially unsafe files. Missing disclosure is especially dangerous here because users may not realize they are granting access to private communications and files from untrusted senders.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill writes digest files containing email metadata such as sender, subject, date, and UID to local disk. Even without full message bodies, this metadata can reveal sensitive relationships, topics, and operational details, especially because it is stored in a shared workspace-style path rather than an obviously private mail cache.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes attachments and message text directly to disk without any warning, confirmation, or opportunity to restrict what gets saved. In an email-processing skill, this is dangerous because mailbox contents often include sensitive files and private communications that can remain exposed on disk after processing.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The lockfile pins package tarball URLs to plain HTTP mirrors, allowing a man-in-the-middle or malicious mirror operator to tamper with dependency downloads in transit. Although integrity hashes provide some protection, using non-TLS sources still weakens supply-chain trust, can leak package metadata, and may enable downgrade or availability attacks depending on installer behavior and environment.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: cli.js:28

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: download-attachments.js:22