ClawHub
Back to skill

Security audit

邮件技能免费版

Security checks for vulnerabilities and agentic risk

Overview

This email skill is not malicious, but it asks users to send mail and store SMTP passwords in a plaintext config file without enough guardrails.

Review this carefully before installing. Use a dedicated app password with minimal scope, keep email_config.json outside source control with restrictive file permissions, confirm every recipient and attachment before sending, and avoid using it for secrets or regulated data unless you have a controlled mail setup.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:107
Finding

Plaintext Storage of SMTP Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 107–122
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code

markdown
## Environment Preparation

Create `email_config.json`:

```json
{
  "smtp_server": "smtp.gmail.com",
  "smtp_port": 587,
  "username": "your-email@gmail.com",
  "password": "your-app-password",
  "sender_name": "Personal Assistant",
  "use_tls": true
}

Gmail users must enable 2FA and generate a 16-character application-specific password from the "App Passwords" page, then enter it in the password field.

text

### Technical Analysis

The skill directs users to place an SMTP application password in a predictable plaintext JSON file. It does not require restrictive file permissions, exclusion from version control, encryption at rest, or integration with an operating-system or cloud secret manager.

Consequently, any local process, AI Agent operation, backup service, repository collaborator, or other principal capable of reading the project directory may obtain the SMTP credential. The risk is increased by the documentation's statement that credentials are supported only through a configuration file rather than through environment variables or secret-management services.

The package contains only `SKILL.md`; the referenced `email_sender.py` implementation is absent. Credential redaction, file-permission enforcement, and secure runtime handling therefore cannot be verified.

### Attack Path

1. A user follows the documented setup and creates `email_config.json`.
2. The user stores a valid SMTP application password in the plaintext `password` field.
3. The file remains accessible through permissive local permissions, an AI Agent read operation, a backup, or an accidental source-control commit.
4. An unauthorized party retrieves the username and application password.
5. The party authenticates
...[truncated 679 chars]
Remediation
View remediation

Remediation Suggestions

  1. Load SMTP credentials from environment variables or a dedicated operating-system or cloud secret manager instead of storing them directly in project configuration.
  2. If file-based credentials must remain supported, store them outside the project tree and require owner-only permissions such as mode 0600 on Unix-like systems.
  3. Add email_config.json to .gitignore and distribute only a sanitized template such as email_config.example.json.
  4. Ensure the eventual sender implementation never logs, returns, or includes SMTP passwords in exceptions or Agent responses.
  5. Validate file ownership and permissions before reading credentials, and fail securely when the file is accessible to unintended users.
  6. Document immediate credential revocation and rotation procedures for suspected exposure.
  7. Prefer short-lived credentials or delegated authorization where supported by the SMTP provider.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill describes sending message bodies and attachments to third-party SMTP providers but does not clearly warn users that email contents will leave the local environment and be processed by external services. In practice, this can lead users to transmit sensitive data without informed consent, especially when an AI agent is orchestrating the workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation guidance tells the agent to execute email-related tasks broadly without defining clear trigger conditions, authorization checks, or recipient/content constraints. In an agent context with read, write, and exec tools, vague activation rules increase the chance the skill is used to send unintended emails, attach sensitive files, or act on ambiguous prompts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill claims custom SMTP is unsupported, yet the documented configuration file exposes raw smtp_server and smtp_port fields that would allow arbitrary outbound mail routing if honored by the implementation. This mismatch weakens user trust and policy assumptions, because operators may believe the skill is constrained to Gmail/Outlook while it can be repointed to any SMTP endpoint, enabling unexpected data exfiltration or delivery through untrusted infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to place SMTP usernames and passwords in a local JSON file, but provides only minimal generic advice and no strong warning about plaintext credential storage. This creates a realistic risk of credential theft through accidental commits, local compromise, insecure permissions, or agent/tool access to the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.