Imap Idle Review

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:39 AM UTC
• Version: 1.4.0

Overview

This email listener appears purpose-built rather than malicious, but it needs review because it handles mailbox passwords, email content, and webhook tokens with several under-scoped safeguards.

Install only if you are comfortable with a long-running process that can access monitored mailboxes and wake your OpenClaw agent on incoming email. Prefer keyring or another secret manager, verify the config file is owner-only, keep the webhook URL on loopback or HTTPS to a trusted host, avoid forwarding body previews unless needed, and treat email-triggered agent actions as untrusted until confirmed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/listener.py:165

Finding

Untrusted Email Content Is Forwarded Directly to the Agent Webhook

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.py:78

Finding

Arbitrary or Plaintext Webhook Destinations Can Receive Email Content and Authentication Tokens

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.py:60

Finding

Plaintext Credentials Are Written Without Enforced Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Dependencies and Skill Artifacts Are Installed Without Version, Hash, or Signature Verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (111)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 42)May include surrounding context.

md

#### Supported Platforms

- **macOS**: Uses Keychain (OS-level encryption, user session)
- **Linux Desktop**: GNOME Keyring, KDE Wallet (user session)
- **Windows**: Credential Manager (OS-level encryption)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

This rollback example retrieves passwords from the system keyring and writes them back into the JSON config as plaintext (account['password'] = password). Even though the intent is legitimate, the documented procedure materially weakens credential security by increasing exposure at rest if the file is later read, backed up, or mishandled.

Content

Scanner excerpt · SECURITY.md (reported line 273)May include surrounding context.

md

for account in config['accounts']:
    username = account['username']
    password = keyring.get_password('imap-idle', username)
    if password:
        account['password'] = password
        print(f'✅ Restored password for {username}')

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Falling back to account_config.get('password') supports storing IMAP passwords in plaintext configuration files, increasing the risk of credential exposure through filesystem compromise, backups, or accidental disclosure. In an email-monitoring skill, compromise of these credentials grants direct mailbox access and can expose large volumes of sensitive communications.

Content

Scanner excerpt · scripts/listener.py (reported line 95)May include surrounding context.

python

self.logger.debug(f"🔐 Using keyring password for {username}")
                    return password
            except Exception as e:
                self.logger.warning(f"⚠️  Keyring access failed for {username}: {e}")
        
        # Fall back to config file
        password = account_config.get('password')

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Falling back to reading IMAP passwords from the JSON config encourages plaintext credential storage on disk. If file permissions are weak, backups are exposed, or the host is shared, attackers can recover mailbox credentials and gain access to monitored accounts.

Content

Scanner excerpt · scripts/listener_old.py (reported line 95)May include surrounding context.

python

self.logger.debug(f"🔐 Using keyring password for {username}")
                    return password
            except Exception as e:
                self.logger.warning(f"⚠️  Keyring access failed for {username}: {e}")
        
        # Fall back to config file
        password = account_config.get('password')

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 191)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 192)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 38)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 49)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 50)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 204)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 221)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 222)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 224)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 226)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 235)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 263)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 265)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 281)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 283)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 292)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 293)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md

import getpass
from pathlib import Path

# Optional keyring support
try:
    import keyring
    KEYRING_AVAILABLE = True

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/listener_old.py:90

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/listener.py:90

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/setup.py:202

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SECURITY.md:273