Security audit

Fastmail Suite

Security checks for vulnerabilities and agentic risk

Overview

This Fastmail skill mostly does what it says, but it can send account credentials to configurable or discovered network destinations without validating they are Fastmail endpoints.

Install only if you are comfortable giving the skill access to Fastmail mail, contacts, and calendars. Use narrow read-only tokens where possible, avoid setting custom FASTMAIL_BASE_URL or FASTMAIL_CALDAV_BASE_URL, do not run with FASTMAIL_ENABLE_WRITES=1 unless you intend to send or modify data, and treat all output as potentially containing private account content despite default redaction.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/jmap_client.py:95
Finding: JMAP bearer token can be transmitted to an untrusted network endpoint
Content: View full analysis
Dict[str, str]: return {"Authorization": f"Bearer {self.token}", "Content-Type": "application/json"} def session(self) -> JmapSession: if self._session: return self._session url = self.base_url + JMAP_SESSION_PATH req = urllib.request.Request(url, headers=self._headers()) try: with urllib.request.urlopen(req, timeout=30) as r: data = json.loads(r.read()) except Exception as e: raise FastmailError(f"Failed to fetch JMAP session: {e}") api_url = data.get("apiUrl") if not api_url: raise FastmailError("JMAP session response missing apiUrl") if self._account_id_override: account_id = self._account_id_override else: accounts = data.get("accounts") or {} if not accounts: raise FastmailError("JMAP session response has no accounts") account_id = list(accounts.keys())[0] self._session = JmapSession(api_url=api_url, account_id=account_id) return self._session def call(self, method_calls: List[list], *, using: Optional[List[str]] = None) -> Dict[str, Any]: sess = self.session() for mc in method_calls: if isinstance(mc, list) and len(mc) >= 2 and isinstance(mc[1], dict): ...[truncated 2442 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/calendar_caldav.py:62
Finding: CalDAV Basic credentials can be sent to attacker-controlled absolute URLs
Content: View full analysis
str: tok = base64.b64encode(f"{user}:{password}".encode()).decode() return f"Basic {tok}" def _req(method: str, url: str, *, user: str, password: str, body: Optional[bytes] = None, headers: Optional[Dict[str, str]] = None): h = { "Authorization": _basic_auth_header(user, password), "User-Agent": "openclaw-fastmail-suite/1.0", } if headers: h.update(headers) return urllib.request.Request(url, data=body, headers=h, method=method) def _base_url() -> str: return (os.environ.get("FASTMAIL_CALDAV_BASE_URL") or DEFAULT_BASE).rstrip("/") ``` ```python href = el.text if href.startswith("http"): return href return _base_url().rstrip("/") + href ``` ```python href = el.text if href.startswith("http"): return href return _base_url() + href ``` ```python href = href_el.text if href.rstrip("/") == home.rstrip("/"): continue name = (name_el.text or "").strip() if name_el is not None else "" if not name: name = href.rstrip("/").split("/")[-1] url = href if href.startswith("http") else _base_url() + href out.append(Calendar(name=name, url=url)) ``` ```python url = href if href.startswith("http") else _base_url() + href event_uid = uid or href.rstrip("/").split("/")[-1].replace(".ics", "") ics = _ics_event(uid=event_uid, summary=summary, start=start, end=end, tz=tz) req = _req( "PUT", url, user=user, password=password, body=ics.encode("utf-8"), headers={"Content-Type": "text/calendar; charset=utf-8", "If-Match": etag}, ) ``` ...[truncated 2769 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/jmap_client.py:52
Finding: Default redaction does not protect most sensitive mailbox and contact content
Content: View full analysis
str: """Best-effort redaction for display/logging (emails, phone-ish numbers).""" if not text: return text # emails: keep domain, mask local part def _mask_email(m: re.Match) -> str: local = m.group(1) domain = m.group(2) if len(local) <= 2: masked = "*" * len(local) else: masked = local[0] + "*" * (len(local) - 2) + local[-1] return f"{masked}@{domain}" text = re.sub(r"\b([A-Za-z0-9._%+-]{1,64})@([A-Za-z0-9.-]+\.[A-Za-z]{2,})\b", _mask_email, text) # phone-ish: sequences of 8+ digits possibly separated by spaces/dashes text = re.sub(r"\b(?:\+?\d[\d\s\-()]{7,}\d)\b", "[REDACTED_PHONE]", text) return text ``` A representative mailbox output sink is: ```python subj = e.get("subject") or "" body = _extract_text_body(e) or "(no body)" if not raw: subj = redact_text(subj) body = redact_text(body) to_line = redact_text(to_line) print(f"Subject: {subj}") print(f"From: {_mask_email_addr(fr_addr)}") print(f"To: {to_line}") print(f"Date: {e.get('receivedAt')}") print(f"Status: {'UNREAD' if unread else 'read'}") print("-" * 72) print(body) ``` Representative contact fields passed through the same limited redactor include: ```python if notes_obj: notes = [v.get("note") for v in notes_obj.values() if isinstance(v, dict) and v.get("note")] if notes: print("Notes:") for n in notes: print(f" - {_fmt_value(n, raw=raw)}") ``` ### Technical Analysis The Skill documentation broadly states that output is redacted by default. Th ...[truncated 2228 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/fastmail.py (reported line 30)May include surrounding context.
python
path = str(HERE / script) cmd = [sys.executable, path, *argv] # Preserve env and let the child handle safety checks. return subprocess.call(cmd, env=os.environ.copy()) def main() -> None:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill handles high-value secrets and performs networked shell-based operations, but it does not declare an explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege guarantees because a host agent may permit broader shell, network, or environment access than intended, increasing the chance of credential exposure or unintended outbound actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script intentionally supports a --raw mode that disables redaction and can print full contact details, including names, emails, phones, addresses, and notes. While this appears to be a deliberate feature rather than malicious behavior, it increases the risk of accidental sensitive-data exposure because there is no prominent runtime confirmation or warning when raw output is requested.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/fastmail.py (reported line 30)May include surrounding context.
python
path = str(HERE / script) cmd = [sys.executable, path, *argv] # Preserve env and let the child handle safety checks. return subprocess.call(cmd, env=os.environ.copy()) def main() -> None:

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The top-level docstring lists only email-oriented subcommands and states 'Read-only operations only', which suggests a mail-focused helper. In practice, status also probes contacts via JMAP and calendars via CalDAV using separate credentials, so the documentation understates and partially misdescribes the implemented scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.