ClawHub
Back to skill

Security audit

邮件日报专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is an email digest helper, but it asks an agent to use logged-in browser sessions, command execution, scheduling, and external push channels for sensitive email content without enough scoping or consent controls.

Review carefully before installing. Only use this with mailboxes and push channels you control, avoid broad browser-session access where possible, confirm every scheduled push or alert destination, and make sure reports are redacted or minimized before sending to Feishu, DingTalk, Slack, email, or webhooks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The skill claims command execution is restricted to a whitelist, but the documentation advertises broad exec-capable workflows including browser automation, scheduling, alerts, and arbitrary CLI-style operations. This mismatch can mislead users and downstream agents about the actual trust boundary, increasing the chance that unsafe commands or data-handling flows are executed under a false assumption of restriction.

Intent-Code Divergence

Medium
Confidence
80% confidence
Finding
The document says no email API key is needed, then later describes API-key authentication failures as a common error case. This inconsistency can cause operators to misconfigure credentials, misunderstand which secrets are in use, and handle sensitive tokens insecurely while troubleshooting.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The invocation guidance is overly broad for common messaging, notification, and communication tasks, which can cause an agent to select this skill in contexts far beyond email digest generation. Because the skill includes exec, write, scheduling, and outbound push behavior, over-selection expands the chance of unintended data access, message sending, or external transmission.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill describes automatic report pushing and real-time alerting to external channels without prominent privacy warnings or explicit consent steps. In this context, the data being transmitted is email-derived content that may contain sensitive business, legal, or personal information, so silent or under-warned outbound delivery materially increases exfiltration risk.

Static analysis

No suspicious patterns detected.