ClawHub
Back to skill

Security audit

Email Cleanup

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about managing Outlook mail, but it needs Review because one instruction could allow persistent forwarding rules that expose future email.

Install only if you will use a trusted runtime that enforces a hard block on forward, redirect, delete, and permanent-delete inbox rule actions. Avoid granting MailboxSettings.ReadWrite unless you truly need rule creation, prefer narrower audit or folder-only scopes when possible, and do not enable autonomous invocation for this skill without runtime-level controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:239
Finding

Contradictory Policy Permits Persistent Email Forwarding Rules

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
## Authentication & Required Scopes

This skill operates against Microsoft Graph and requires an OAuth 2.0 delegated access token for a Microsoft 365 account.

### Minimum scopes by use case

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
description: >-
  Organize a cluttered Outlook inbox with folders, batch moves, and server-side
  inbox rules via the Microsoft Graph API. Use when user says "clean up my inbox,"
  "organize email," "create email folders," "inbox rules," "filter notifications,"
  "unclutter inbox," "sort my email," "move GitHub notifications," "email
  folders," or "auto-sort email." Covers one-time cleanup and ongoing automation.
license: Apache-2.0

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly defines forwarding and redirect actions as dangerous because they can silently exfiltrate email, then later weakens that rule by allowing forwarding if the user confirms the destination. In a high-risk mailbox automation context, that exception creates an instruction path for persistent email exfiltration and undermines the stated security model, especially because the skill itself cannot enforce runtime safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.