ClawHub
Back to skill

Security audit

163邮箱管理专家

Security checks for vulnerabilities and agentic risk

Overview

This skill is for 163.com email management, but it asks agents to handle sensitive mailbox access and destructive email actions without tight enough scope or confirmation guidance.

Review carefully before installing. Use it only for a dedicated 163.com mailbox, require explicit confirmation before sending, moving, or deleting mail, avoid bulk delete unless you have reviewed the exact messages, and prefer a secure secret store over a plaintext config file or exposed environment variable for the authorization code.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:233
Finding

Persistent Plaintext Storage of Mailbox Authorization Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 233-254
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Documentation Snippet

markdown
A: The default path is `~/.config/email-163-com/config.json`. It contains
`email`, `password` (authorization code), `imap_server` (`imap.163.com`),
`imap_port` (993), `smtp_server` (`smtp.163.com`), and `smtp_port` (465).
The environment variables `EMAIL_163_USER` and `EMAIL_163_PASS` may be used
instead. It is recommended to execute `chmod 600 config.json` to set file
permissions.

- The configuration file stores the authorization code in plaintext and
  requires the user to set file permissions to mode 600 manually.

Technical Analysis

The Skill documentation instructs users to persist a reusable 163 Mail authorization code in the password field of a plaintext JSON file. File mode 0600 restricts access by other local accounts, but it does not encrypt the credential or protect it from processes running under the mailbox owner's account. It also relies on the user to apply the restriction manually, creating a risk that the file may initially or permanently retain broader permissions.

A local process operating with the user's privileges can read the authorization code directly. The credential may also be exposed through unencrypted backups, copied home directories, diagnostic archives, accidental publication, or improperly configured synchronization and version-control workflows.

No executable implementation is included in the audited project, so configuration creation behavior, permission enforcement, secret redaction, and credential lifecycle controls cannot be verified.

Attack Path

  1. A user follows the documented configuration procedure.
  2. The user writes the mailbox address and reusable authorization code to ~/.config/email-163-com/config.json.
  3. The user omits chmod 600, applies it in ...[truncated 1199 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store authorization codes in an operating-system credential manager, platform secret store, or agent-managed encrypted vault rather than a plaintext JSON file.
  2. Prefer secret references in the configuration file so that the file contains only non-sensitive settings.
  3. If environment variables are supported, warn that they can be inherited by child processes and may be exposed through process diagnostics; use a dedicated secret-injection facility where available.
  4. If file-based storage is unavoidable, create the credential file atomically with mode 0600 from the outset rather than asking the user to correct permissions afterward.
  5. Refuse to use credential files that are owned by another account, are symbolic links, or have group or world permissions.
  6. Exclude credential files from version control, cloud synchronization, backups, logs, crash reports, and support archives.
  7. Redact authorization codes from command output, errors, telemetry, and debug logs.
  8. Document credential rotation and revocation procedures, and instruct users to revoke the authorization code immediately after suspected disclosure.
  9. Add automated tests verifying restrictive file creation, permission validation, secret redaction, and safe failure behavior.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation and usage description is overly broad, covering generic messaging, notifications, communication integration, and automation without tight scope boundaries. In an agent setting, vague activation criteria can cause the skill to be invoked in unintended contexts, increasing the chance of unsolicited email actions or handling sensitive communications without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes bulk deletion of all mail in the spam folder using a destructive command, but the warning is only procedural and does not clearly require explicit confirmation or highlight irreversible consequences. In an agent workflow, this can lead to accidental mass deletion of messages, including misclassified or important emails, if the action is triggered automatically or ambiguously.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md
### Q1: 为什么必须使用客户端授权码而不是登录密码?
A: 163邮箱出于安全考虑,IMAP/SMTP登录必须使用客户端授权码而非账号登录密码。获取方式:登录163网页版 → 设置 → POP3/SMTP/IMAP → 开启服务并生成授权码。授权码仅显示一次,请妥善保存.
### Q2: 配置文件应该放在哪里?格式是什么?
A: 默认路径 `~/.config/email-163-com/config.json`,包含 `email`、`password`(授权码)、`imap_server`(imap.163.com)、`imap_port`(993)、`smtp_server`(smtp.163.com)、`smtp_port`(465)等字段。也可使用环境变量 `EMAIL_163_USER` 和 `EMAIL_163_PASS` 替代配置文件。建议执行 `chmod 600 config.json` 设置文件权限.
### Q3: 如何发送HTML格式邮件?
A: 使用 `--html` 参数直接传入HTML内容,如 `email-163-com send --to x@example.com --subject "Hello" --html "<h1>标题</h1><p>正文</p>"`。HTML内容较长时建议使用 `--file` 指定HTML文件,避免命令行转义问题.
### Q4: IMAP ID是什么?为什么163邮箱必需?

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md
## 安全提示
| 风险项 | 等级 | 防护措施 | 验证方法 |
|:------:|:----:|:-------:|:-------:|
| 配置文件泄露 | 高 | 限制配置文件访问权限 | 使用 `ls -l ~/.json` 检查权限 |
| 授权码泄露 | 高 | 使用安全方式存储授权码 | 确保授权码不在版本控制系统中 |
| 邮件内容泄露 | 中 | 使用加密连接 | 检查配置文件中的 `imap_port` 和 `smtp_port` 是否为加密端口 |
| 邮件被恶意攻击 | 高 | 设置垃圾邮件过滤器 | 使用163邮箱的垃圾邮件过滤器功能 |

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

In the feature overview, the skill is described as having 'API integration' and 'command execution in a sandbox' (L298-L299), and earlier it is also labeled 'MD+EXEC' (L078-L079). However, the dependency section at the end explicitly reclassifies it as 'MD（纯Markdown指令，通过自然语言驱动Agent完成操作）' with no executable component (L350-L352). These statements actively contradict each other about whether the skill performs actual command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description explicitly states 支持中文交互, and the file is predominantly framed around Chinese interaction without offering a language choice. This can constitute a language/locale policy issue because it implies a default language constraint rather than presenting localization as an option.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.