agentmail-cli

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:49 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward AgentMail email CLI helper, with disclosed credential use and email deletion capabilities that users should handle carefully.

Install only if you trust the npm package source, prefer a scoped or temporary AGENTMAIL_API_KEY when possible, avoid storing the key persistently on shared machines, and require explicit confirmation before sending email or deleting inboxes/messages because message deletion removes the thread.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Third-Party CLI Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Unpinned executable npm dependency **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml metadata: {"openclaw":{"emoji":"📧","requires":{"bins":["agentmail"],"env":["AGENTMAIL_API_KEY"]},"primaryEnv":"AGENTMAIL_API_KEY","install":[{"id":"npm","kind":"node","package":"@stepandel/agentmail-cli","bins":["agentmail"],"label":"Install agentmail-cli via npm"}]}} ``` ### Technical Analysis The installation metadata references `@stepandel/agentmail-cli` without an exact version or integrity digest. Consequently, installation may resolve to a future package release whose contents differ from those reviewed when the Skill was published. Because the installed package provides the executable invoked by the Skill, a malicious or compromised release could run with the agent process's local privileges. The executable is also expected to receive or access `AGENTMAIL_API_KEY` and process email data, increasing the sensitivity of a supply-chain compromise. The audit did not establish that the current package is malicious. The vulnerability is the use of mutable, unverified dependency resolution for a security-sensitive executable. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution path, or another relevant release mechanism for `@stepandel/agentmail-cli`. 2. The attacker publishes a malicious package version that remains compatible with the expected `agentmail` binary name. 3. A user or agent installs the dependency through the unpinned installation declaration. 4. npm resolves and installs the attacker-controlled release because no audited version or integrity value is enforced. 5. The Skill invokes the installed `agentmail` executable. 6. The malicious executable runs with the invoking process's permissions and may access the AgentMail API key, email content, configuration files, and other resources avai ...[truncated 690 chars]
• Remediation: ## Remediation Suggestions - Pin `@stepandel/agentmail-cli` to an exact version that has been reviewed and approved. - Enforce package integrity using a lockfile, cryptographic integrity digest, or an equivalent verified artifact mechanism supported by the Skill installation platform. - Avoid version ranges and mutable tags such as `latest`. - Verify the npm package publisher, source repository, release provenance, and package contents before approval. - Run the CLI with least privilege and expose `AGENTMAIL_API_KEY` only to the specific process that requires it. - Use automated dependency monitoring, but require review and integrity updates before adopting new releases. - Where supported, install from an internal registry or artifact repository containing only vetted package versions.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: agentmail-cli
description: Manage email inboxes and messages via AgentMail API. Create disposable inboxes, send/receive emails, and list messages. Use when the agent needs to send or receive email, create temporary inboxes, or check for incoming messages.
metadata: {"openclaw":{"emoji":"📧","requires":{"bins":["agentmail"],"env":["AGENTMAIL_API_KEY"]},"primaryEnv":"AGENTMAIL_API_KEY","install":[{"id":"npm","kind":"node","package":"@stepandel/agentmail-cli","bins":["agentmail"],"label":"Install agentmail-cli via npm"}]}}
homepage: https://github.com/stepandel/agentmail-cli
---

• Confidence: 72% confidence
• Finding: This skill is explicitly designed to persist authentication material and mailbox state across sessions, including storing an API key in ~/.agentmail/config.json and managing inboxes/messages over time. In an agent environment, session persistence broadens the blast radius of compromise or misuse because future runs may inherit live credentials and retain access to prior inboxes and potentially sensitive email content.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents destructive delete operations for inboxes without any warning about permanence, verification steps, or confirmation guidance. In an agent context, this increases the chance of accidental data loss because an automated workflow may invoke deletion directly on the basis of ambiguous user intent or stale identifiers.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation notes that deleting a message deletes the entire thread, but it does so as a brief note rather than a prominent safety warning adjacent to the delete command. That creates a meaningful risk of unintended bulk deletion of conversation history when an agent or user believes they are removing only a single message.

Static analysis

No suspicious patterns detected.