Fastmail Suite

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:29 AM UTC
• Version: 0.1.4

Overview

This Fastmail skill mostly does what it says, but it can send account credentials to configurable or discovered network destinations without validating they are Fastmail endpoints.

Install only if you are comfortable giving the skill access to Fastmail mail, contacts, and calendars. Use narrow read-only tokens where possible, avoid setting custom FASTMAIL_BASE_URL or FASTMAIL_CALDAV_BASE_URL, do not run with FASTMAIL_ENABLE_WRITES=1 unless you intend to send or modify data, and treat all output as potentially containing private account content despite default redaction.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/jmap_client.py:95
• Finding: JMAP bearer token can be transmitted to an untrusted network endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/jmap_client.py:95-141` **Vulnerability Type**: Unrestricted credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```python class FastmailJMAP: def __init__(self, token: str, *, base_url: Optional[str] = None, account_id: Optional[str] = None): self.token = token self.base_url = (base_url or os.environ.get("FASTMAIL_BASE_URL") or DEFAULT_BASE_URL).rstrip("/") self._account_id_override = account_id or os.environ.get("FASTMAIL_ACCOUNT_ID") self._session: Optional[JmapSession] = None def _headers(self) -> Dict[str, str]: return {"Authorization": f"Bearer {self.token}", "Content-Type": "application/json"} def session(self) -> JmapSession: if self._session: return self._session url = self.base_url + JMAP_SESSION_PATH req = urllib.request.Request(url, headers=self._headers()) try: with urllib.request.urlopen(req, timeout=30) as r: data = json.loads(r.read()) except Exception as e: raise FastmailError(f"Failed to fetch JMAP session: {e}") api_url = data.get("apiUrl") if not api_url: raise FastmailError("JMAP session response missing apiUrl") if self._account_id_override: account_id = self._account_id_override else: accounts = data.get("accounts") or {} if not accounts: raise FastmailError("JMAP session response has no accounts") account_id = list(accounts.keys())[0] self._session = JmapSession(api_url=api_url, account_id=account_id) return self._session def call(self, method_calls: List[list], *, using: Optional[List[str]] = None) -> Dict[str, Any]: sess = self.session() for mc in method_calls: if isinstance(mc, list) and len(mc) >= 2 and isinstance(mc[1], dict): ...[truncated 2442 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require `https` for the base URL and every session-provided API URL. 2. Allowlist the expected Fastmail hostname, such as `api.fastmail.com`, unless support for another deployment is an explicit requirement. 3. Parse and canonicalize URLs with `urllib.parse.urlsplit`; reject embedded credentials, unexpected ports, fragments, and non-HTTPS schemes. 4. Verify that `apiUrl` remains on an approved origin before attaching the bearer token. 5. Apply equivalent validation to redirect destinations, or disable automatic redirects for authenticated requests and validate redirects manually. 6. Avoid permitting `FASTMAIL_BASE_URL` in normal production operation. If retained for testing, require a separate explicit development mode and never reuse production credentials. 7. Continue recommending narrowly scoped, read-only tokens and require `FASTMAIL_TOKEN_SEND` rather than falling back to a general read token for sending. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/calendar_caldav.py:62
• Finding: CalDAV Basic credentials can be sent to attacker-controlled absolute URLs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/calendar_caldav.py:62-99, 102-171, 198-210, 425-437, 470-472` **Vulnerability Type**: Unrestricted credential-bearing CalDAV destination **Risk Level**: High ### Vulnerable Code ```python def _basic_auth_header(user: str, password: str) -> str: tok = base64.b64encode(f"{user}:{password}".encode()).decode() return f"Basic {tok}" def _req(method: str, url: str, *, user: str, password: str, body: Optional[bytes] = None, headers: Optional[Dict[str, str]] = None): h = { "Authorization": _basic_auth_header(user, password), "User-Agent": "openclaw-fastmail-suite/1.0", } if headers: h.update(headers) return urllib.request.Request(url, data=body, headers=h, method=method) def _base_url() -> str: return (os.environ.get("FASTMAIL_CALDAV_BASE_URL") or DEFAULT_BASE).rstrip("/") ``` ```python href = el.text if href.startswith("http"): return href return _base_url().rstrip("/") + href ``` ```python href = el.text if href.startswith("http"): return href return _base_url() + href ``` ```python href = href_el.text if href.rstrip("/") == home.rstrip("/"): continue name = (name_el.text or "").strip() if name_el is not None else "" if not name: name = href.rstrip("/").split("/")[-1] url = href if href.startswith("http") else _base_url() + href out.append(Calendar(name=name, url=url)) ``` ```python url = href if href.startswith("http") else _base_url() + href event_uid = uid or href.rstrip("/").split("/")[-1].replace(".ics", "") ics = _ics_event(uid=event_uid, summary=summary, start=start, end=end, tz=tz) req = _req( "PUT", url, user=user, password=password, body=ics.encode("utf-8"), headers={"Content-Type": "text/calendar; charset=utf-8", "If-Match": etag}, ) ``` ...[truncated 2769 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for `FASTMAIL_CALDAV_BASE_URL` and all discovered or user-provided URLs. 2. Pin authenticated requests to the canonical Fastmail CalDAV origin, normally `caldav.fastmail.com`. 3. Resolve relative hrefs with `urllib.parse.urljoin` and reject absolute hrefs whose origin differs from the validated base origin. 4. Validate principal, calendar-home, calendar-resource, update, and delete URLs before calling `_req()`. 5. Reject embedded user information, unexpected ports, scheme-relative URLs, and malformed URLs. 6. Disable cross-origin redirects for requests carrying `Authorization`, or process redirects manually and revalidate their destinations. 7. Do not accept arbitrary absolute `--href` values. Accept server-issued relative paths or opaque event identifiers and resolve them internally. 8. Preserve the existing write-enable check, but do not rely on it as a network credential control. 9. Use a narrowly scoped Fastmail calendar app password so compromise does not expose unrelated account capabilities. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/jmap_client.py:52
• Finding: Default redaction does not protect most sensitive mailbox and contact content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/jmap_client.py:52-75`; output sinks include `scripts/mail.py:218-239` and `scripts/contacts.py:271-342` **Vulnerability Type**: Incomplete sensitive-data redaction **Risk Level**: Medium ### Vulnerable Code ```python def redact_text(text: str) -> str: """Best-effort redaction for display/logging (emails, phone-ish numbers).""" if not text: return text # emails: keep domain, mask local part def _mask_email(m: re.Match) -> str: local = m.group(1) domain = m.group(2) if len(local) <= 2: masked = "*" * len(local) else: masked = local[0] + "*" * (len(local) - 2) + local[-1] return f"{masked}@{domain}" text = re.sub(r"\b([A-Za-z0-9._%+-]{1,64})@([A-Za-z0-9.-]+\.[A-Za-z]{2,})\b", _mask_email, text) # phone-ish: sequences of 8+ digits possibly separated by spaces/dashes text = re.sub(r"\b(?:\+?\d[\d\s\-()]{7,}\d)\b", "[REDACTED_PHONE]", text) return text ``` A representative mailbox output sink is: ```python subj = e.get("subject") or "" body = _extract_text_body(e) or "(no body)" if not raw: subj = redact_text(subj) body = redact_text(body) to_line = redact_text(to_line) print(f"Subject: {subj}") print(f"From: {_mask_email_addr(fr_addr)}") print(f"To: {to_line}") print(f"Date: {e.get('receivedAt')}") print(f"Status: {'UNREAD' if unread else 'read'}") print("-" * 72) print(body) ``` Representative contact fields passed through the same limited redactor include: ```python if notes_obj: notes = [v.get("note") for v in notes_obj.values() if isinstance(v, dict) and v.get("note")] if notes: print("Notes:") for n in notes: print(f" - {_fmt_value(n, raw=raw)}") ``` ### Technical Analysis The Skill documentation broadly states that output is redacted by default. Th ...[truncated 2228 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the documentation to explicitly describe redaction as limited, best-effort masking rather than general protection. 2. Default mailbox and contact commands to metadata-only output. 3. Require a separate explicit confirmation or flag before returning message bodies, contact notes, addresses, or complete records. 4. Use structured allowlists for default output rather than retrieving broad objects and applying regex substitutions afterward. 5. Add detection and masking for common secret formats, authorization headers, API keys, one-time codes, credential URLs, account numbers, and other project-relevant sensitive fields. 6. Mask URL query parameters and fragments because they commonly contain reset or authentication tokens. 7. Apply output limits to all body, note, preview, and dump paths. 8. Clearly warn that `--raw`, `--full`, and contact `--dump` can expose complete private records. 9. Consider requiring an interactive or policy-level approval for raw output when the scripts run in an Agent context. 10. Add automated tests containing representative secrets to verify that default commands do not emit them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

path = str(HERE / script)
    cmd = [sys.executable, path, *argv]
    # Preserve env and let the child handle safety checks.
    return subprocess.call(cmd, env=os.environ.copy())


def main() -> None:

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill handles high-value secrets and performs networked shell-based operations, but it does not declare an explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege guarantees because a host agent may permit broader shell, network, or environment access than intended, increasing the chance of credential exposure or unintended outbound actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script intentionally supports a `--raw` mode that disables redaction and can print full contact details, including names, emails, phones, addresses, and notes. While this appears to be a deliberate feature rather than malicious behavior, it increases the risk of accidental sensitive-data exposure because there is no prominent runtime confirmation or warning when raw output is requested.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

path = str(HERE / script)
    cmd = [sys.executable, path, *argv]
    # Preserve env and let the child handle safety checks.
    return subprocess.call(cmd, env=os.environ.copy())


def main() -> None:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Low

• Confidence: 77% confidence
• Finding: The top-level docstring lists only email-oriented subcommands and states 'Read-only operations only', which suggests a mail-focused helper. In practice, `status` also probes contacts via JMAP and calendars via CalDAV using separate credentials, so the documentation understates and partially misdescribes the implemented scope.

Static analysis

No suspicious patterns detected.