邮件技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:12 AM UTC
• Version: 1.0.1

Overview

This SMTP email skill has a coherent email-sending purpose, but its broad tool authority, contradictory execution claims, unrelated capability claims, and weak credential/privilege guidance require review before use.

Install only if you specifically need SMTP email sending. Use a dedicated, revocable SMTP/app password; avoid storing secrets in the project workspace; do not run the agent as administrator; verify recipients, attachments, proxy settings, and any multi-account behavior before sending. Treat the unrelated security-scanning and generic command-execution sections as documentation defects unless the publisher clarifies scope.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:100

Finding

Plaintext SMTP Credentials in the Recommended Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 100-101
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: High

Vulnerable Code

json

"username": "[e-mail]",
"password": "your-app-password",

Technical Analysis

The documented setup instructs users to place an SMTP username and application password directly in email_config.json. Although the document later acknowledges that plaintext configuration files are risky, it does not require restrictive file permissions, exclusion from version control, secure deletion, or integration with a dedicated secret-management system.

An SMTP application password is an authentication secret. If the working directory is readable by other users or processes, included in a backup, shared with an AI Agent, or accidentally committed to source control, the credential can be recovered without defeating encryption or authentication controls.

The alternative environment-variable example reduces the likelihood of a repository commit but does not fully resolve the issue. Environment variables may still be exposed through process inspection, diagnostic output, shell history, crash reports, or inherited child processes.

Attack Path

1. A user follows the documented setup and creates email_config.json in the project working directory.
2. The user replaces the placeholder with a valid SMTP application password.
3. The file remains accessible through repository commits, backups, workspace sharing, Agent file access, or another local process.
4. An attacker obtains the username and application password.
5. The attacker authenticates directly to the configured SMTP provider.
6. The compromised account is used to send unauthorized email, impersonate the sender, distribute phishing messages, or consume the provider's sending quota.

Impact Assessment

Exploitation grants the attacker the email-sending privileges associated ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

1. Make an operating-system credential store or managed secret service, such as Vault or a cloud secret manager, the default authentication mechanism.
2. If a configuration file is unavoidable, store only a secret reference in the project and keep the credential in a separate protected location.
3. Require owner-only permissions on secret files, such as mode 0600 on Unix-like systems, and document equivalent Windows ACL restrictions.
4. Add email_config.json and related credential files to .gitignore.
5. Provide a sanitized email_config.example.json containing placeholders only.
6. Prohibit credentials from appearing in logs, exception messages, command output, or structured delivery results.
7. Avoid interactive export commands that can enter shell history; document secure environment injection by the process supervisor instead.
8. Use narrowly scoped, revocable application credentials and document immediate rotation following suspected exposure.
9. Add startup checks that reject secret files with unsafe permissions where the operating system supports such validation.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:338

Finding

Troubleshooting Guidance Encourages Unnecessary Administrator Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 338
Vulnerability Type: Unsafe privilege-escalation guidance
Risk Level: Medium

Vulnerable Instruction

The troubleshooting table provides the following guidance for a permission error:

text

Permission denied | The current user lacks read/write permission | Check file permissions and run as administrator

The same recommendation is repeated at line 360.

Technical Analysis

SMTP delivery and access to user-selected message or attachment files do not ordinarily require administrator privileges. Recommending that the entire Agent or workflow run as administrator violates least-privilege principles and broadens access to unrelated system files, credentials, configuration, and protected resources.

This is particularly risky because the skill declares command-execution, read, and write capabilities. Although the package contains no executable implementation and no malicious command was identified, elevating the hosting Agent would cause any subsequently executed command or file operation to inherit excessive privileges. The recommendation treats elevation as a generic solution instead of identifying the specific file, directory, ownership, or access-control failure.

Attack Path

1. The workflow encounters a permission error while reading an attachment, writing a configuration file, or accessing another path.
2. The user follows the troubleshooting guidance and restarts the Agent or terminal with administrator privileges.
3. The elevated workflow processes user-controlled paths, files, message templates, or commands.
4. A malformed input, unsafe future implementation, compromised dependency, or unintended Agent action executes with administrator privileges.
5. The resulting operation can access or modify resources that were outside the legitimate scope of sending email.

No direct privilege-escalation exploit is shipped in this project. The ...[truncated 670 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the generic recommendation to run the Agent or workflow as administrator.
2. Diagnose the exact inaccessible file or directory and correct only its ownership or access-control entry.
3. Run the Agent under a dedicated, unprivileged account with access limited to the required working directory, attachments, and secret references.
4. Reject attachment and configuration paths outside explicitly permitted directories.
5. Use read-only access for attachments and grant write access only to narrowly scoped output locations.
6. If a privileged setup action is genuinely required, isolate it in a small, reviewed command rather than elevating the complete Agent session.
7. Log permission failures without disclosing credentials or sensitive file contents.
8. Apply the correction to both duplicated troubleshooting entries at lines 338 and 360.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as an SMTP email sender, but it also advertises unrelated security-scanning and vulnerability-management capabilities. This kind of scope inconsistency can mislead users and agents about what actions the skill may attempt, increasing the chance of over-broad invocation, unsafe trust, or unintended handling of sensitive data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document claims command-execution capability even though the skill is otherwise described as a Markdown email skill. For an agent, that discrepancy is dangerous because it may justify use of powerful exec tooling under a benign-looking email label, enabling filesystem or shell actions beyond user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill’s display name, summary, and primary description are presented in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation wording is overly broad, effectively saying to use the skill whenever the user needs email-related functionality. Broad triggers can cause over-invocation, including in contexts where sensitive content, attachments, or credentials may be sent externally without a narrowly scoped user request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation does not clearly warn that email bodies, recipient addresses, and attachments may be transmitted to third-party SMTP providers. In a skill designed for external communication, missing disclosure increases the likelihood of users inadvertently sending confidential or regulated data outside their trust boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill declares contradictory availability classifications: one section says MD+EXEC and another says pure Markdown. Conflicting execution semantics make it harder for users and platforms to reason about the trust boundary and whether the skill can run commands, which directly affects risk assessment and sandboxing decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The capability-boundary section says the skill is limited to SMTP sending, while other sections describe proxy support and multi-account orchestration. These undocumented scope expansions can cause users or orchestrators to underestimate network reach and credential handling behavior, which is risky for a skill that processes secrets and external communications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.