ClawHub
Back to skill

Security audit

Fastmail JMAP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Fastmail email CLI that discloses its broad mailbox access, but users should treat it as sensitive because it can read, send, and modify email.

Install only for a Fastmail account or mailbox you are comfortable letting an agent read and modify. Use the narrowest Fastmail token practical, require explicit approval before sending or changing messages, avoid unattended cron monitoring unless you have a clear need, and be cautious with terminal output from untrusted email senders.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fastmail.py:164
Finding

Unsanitized Email Content Enables Terminal Output Injection

Content
View full analysis
") print(f" To: {to}") if cc: print(f" CC: {cc}") print(f" Date: {e['receivedAt']}") print(f" Status: {'UNREAD' if unread else 'read'}") print(f" {'─' * 60}") body_text = "" for part in e.get("textBody", []): val = e.get("bodyValues", {}).get(part["partId"], {}) if val.get("value"): body_text += val["value"] if not body_text: for part in e.get("htmlBody", []): val = e.get("bodyValues", {}).get(part["partId"], {}) if val.get("value"): body_text += val["value"] print(body_text[:5000] if body_text else " (no body)") ``` Additional affected output path: ```python subj = e.get("subject", "(no subject)") print(f" {flag} {dt} | {fr:30s} | {subj}") print(f" {e['preview'][:120]}") print(f" id: {e['id']}") print() ``` ### Technical Analysis Email subjects, sender names, sender addresses, previews, and message bodies are controlled by external email senders. The script prints these values directly to the terminal without removing or escaping terminal control characters. A malicious message can contain ANSI or OSC escape sequences. Depending on the terminal emulator, these sequences can: - Change colors or overwrite visible terminal content. - Hide or forge status messages and command output. - Render deceptive terminal hyperlinks. - Change terminal titles. - Attempt clipboard manipulation through supported OSC sequences. - Mislead a human or an AI agent that consumes captured terminal output. Truncating the body by character count does not mitigate the issue because a functional escape sequence can fit within a few bytes. This flaw does not, by itself, execute shell ...[truncated 1321 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/fastmail.py:73
Finding

Configured Sender Identity Causes Send Command Failure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tainted flow: 'req' from os.environ.get (line 51, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fastmail.py (reported line 40)May include surrounding context.

python
return
    headers = {"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"}
    req = urllib.request.Request("https://api.fastmail.com/jmap/session", headers=headers)
    session = json.loads(urllib.request.urlopen(req).read())
    ACCOUNT = list(session["accounts"].keys())[0]

Tainted flow: 'req' from os.environ.get (line 51, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fastmail.py (reported line 52)May include surrounding context.

python
headers = {"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"}
    body = json.dumps({"using": using or USING, "methodCalls": method_calls}).encode()
    req = urllib.request.Request(API, body, headers, method="POST")
    resp = json.loads(urllib.request.urlopen(req).read())
    # Check for errors
    for mr in resp.get("methodResponses", []):
        if mr[0] == "error":

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

}

text

Or use 1Password injection: `op run --env-file=.env -- python3 scripts/fastmail.py unread`

## How It Works

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
- `SKILL.md` — this file

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises capabilities that require environment-variable access and outbound network access, but it does not declare any explicit tool scope or permissions boundary. That weakens least-privilege controls and makes it easier for an agent runtime to grant broader access than users may expect, especially for a skill that can read and send email.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The introductory description encourages agents to read and manage email but does not immediately warn that mailbox contents are highly sensitive personal and business data. Users may enable the skill without understanding that it grants broad access to potentially confidential communications and attachments.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

Sending email

  • python3 scripts/fastmail.py send "user@example.com" "Subject" "Body text"
  • Always ask before sending. Never send without approval.
text

### In heartbeat/cron:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The heartbeat/cron guidance recommends unattended inbox monitoring and summarization without a clear warning about continuous surveillance of sensitive email. Persistent automated access increases the chance of overcollection, privacy violations, and unnoticed processing of confidential or regulated content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fastmail.py (reported line 28)May include surrounding context.

python
print("Get one at: https://app.fastmail.com/settings/security/tokens", file=sys.stderr)
    sys.exit(1)

API = "https://api.fastmail.com/jmap/api/"
USING = ["urn:ietf:params:jmap:core", "urn:ietf:params:jmap:mail", "urn:ietf:params:jmap:submission"]
ACCOUNT = None
IDENTITY = None

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fastmail.py (reported line 39)May include surrounding context.

python
print("Get one at: https://app.fastmail.com/settings/security/tokens", file=sys.stderr)
    sys.exit(1)

API = "https://api.fastmail.com/jmap/api/"
USING = ["urn:ietf:params:jmap:core", "urn:ietf:params:jmap:mail", "urn:ietf:params:jmap:submission"]
ACCOUNT = None
IDENTITY = None

Static analysis

No suspicious patterns detected.