Security audit

MailClaw

Security checks for vulnerabilities and agentic risk

Overview

MailClaw has a legitimate email-automation purpose, but it asks for broad ongoing account access and includes under-scoped host-runbook, credential, and scheduling behavior that needs careful review.

Review this before installing in any real inbox. Confirm you trust the MailClaw backend, are comfortable storing an API key locally, and understand that Gmail-derived summaries or content can be sent to connected apps. Prefer a pinned install, verify the API domain, and make sure you can disable the heartbeat tasks and revoke Gmail or app access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:515
Finding: Unauthenticated Host-Instruction Override Permits Skill Instruction Hijacking
Content: View full analysis
Remediation: View remediation
/HEARTBEAT.md` 4. Reject all user-supplied paths, relative paths, traversal segments, symbolic-link escapes, and alternate endpoints. 5. Resolve and verify the canonical path before reading a runbook. 6. State explicitly that runbooks cannot override platform safety policies, secret-handling controls, authorization boundaries, or per-action confirmation requirements. 7. If authenticated event metadata is unavailable, disable host-initiated runbook execution entirely. ]]>

T06 · System Persistence

Error

Location: setup.md:7
Finding: Persistent One-Minute Heartbeat Registration Expands Cross-Session Access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:63
Finding: Plaintext API-Key Storage and Repeated Transmission to a Temporary Tunnel Endpoint
Content: View full analysis
`, except `/daily-token/verify`, `/daily-token/verify-code`, and OAuth callbacks. ... Use `curl` or any HTTP tool. Example: ```bash curl -s -H "X-User-Key: $API_KEY" \ "https://concentrate-patent-cent-sent.trycloudflare.com/emails?limit=10" ``` ``` ```markdown ### Step 1 — Load or create `config.json` 1. Read `{baseDir}/config.json`. 2. If missing or empty: - Greet the user and start first-time setup. ... - Once the user provides a key, validate it: `GET /auth/status/all`. - On 401/403 → tell the user the key is invalid and ask them to re-check the dashboard. - On success → save: ```json { "api_key": "" } ``` The skill stores **only** the API key locally. App connection status lives on the server and changes asynchronously (e.g. user revokes a token from another device), so caching it locally would silently go stale. 3. If present → use the stored `api_key` for all subsequent calls. ``` The recurring runbook also consumes this credential: ```markdown 1. Read `{baseDir}/config.json` to get `api_key`. If missing, reply `HEARTBEAT_FAIL: config.json not found` and stop. 2. Fetch emails: GET /emails?unprocessed_only=true ``` ### Technical Analysis The Skill stores a bearer-equivalent API credential directly in `config.json`. No restrictive permissions, secret-manager integration, encryption-at-rest requirement, log-redaction policy, or credential-rotation procedure is specified. The key is then sent in the `X-User-Key` header to a `trycloudflare.com` tunnel hostname. That destination differs from the dashboard domain that issues the key and appears op ...[truncated 2116 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:6
Finding: Unpinned Third-Party Skill Installation Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (17)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
- **Gmail**: send new emails, send replies (read-only otherwise; the server does the reading) - **Notion**: create pages - **Google Calendar**: create events - **Slack**: send messages to channels - **Linear**: create issues - **HubSpot**: create records - **MailClaw rules**: create, update, delete automation rules that govern future server-side processing

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
If a user pushes for blanket approval, explain briefly: "Each email needs its own confirmation — this prevents one bad classification from cascading into a wrong task, calendar invite, or Slack message. It's just one digit per email." Then continue presenting cards. Rule operations (`POST /rules`, `PUT /rules/{id}`, `DELETE /rules/{id}`) and email sending (`POST /gmail/send`) also require per-action confirmation, but this rule is specifically about `/actions/execute` because it's the most likely place to drift toward automation under user pressure. ## Supported Apps

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.
md
**Steps:** 1. Always start with `GET /rules` so you have IDs and current state. 2. For updates and deletes, identify the target by matching the user's description against rule names. If multiple rules could match, list them and ask which one — don't guess, since the wrong delete is irreversible. 3. Confirm before `PUT /rules/{id}` or `DELETE /rules/{id}`. **Example — list:**

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.
All emails are unmatched by definition. Lead with a warning and end with the rule-setup prompt:

text
⚠️ You have no rules yet — none of these emails will trigger automation. ☀️ Email Digest · <date>

Ssd 1

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to treat host-injected content placed in the user message slot as authoritative and to follow it exactly, allowing externally supplied instructions to override the normal conversational safety model. Because the same skill can read email, generate links, send mail, and manage persistent rules, this creates a powerful prompt-injection and privilege-confusion path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description downplays the security-sensitive behavior by presenting the feature as a simple digest fetch, while omitting that it retrieves email-derived summaries and generates a processing link plus verification code from a remote service. This is risky because users may not realize that potentially sensitive email metadata and access-enabling artifacts are being handled, which weakens informed consent and can expose private workflow or message information if the server or output channel is untrusted.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README describes automatic polling, scheduled heartbeats, and server-side email analysis, but it does not prominently warn users that inbox data will be accessed on an ongoing background basis after setup. This matters because users may grant Gmail access expecting interactive use only, while the skill continues to ingest and process sensitive email content autonomously.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example prompt "Check my email" is a very generic phrase that could easily overlap with ordinary conversation, making unintended invocation more likely. The README does not provide narrowing constraints or negative examples to clarify when this skill should activate versus when it should not.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes workflows that convert emails into actions across Slack, Notion, Calendar, Linear, and HubSpot, but it does not clearly warn that email-derived content may be forwarded into third-party services automatically. In the context of email automation, this increases the chance of sensitive, regulated, or confidential inbox data being propagated to external platforms without users fully understanding the disclosure boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger definition is extremely broad and includes implicit workflow descriptions, causing the skill to activate for many loosely related requests. In a skill with email access and action-taking capabilities, unintended invocation can expose inbox data or start side-effecting flows the user did not intend to use.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
This is a hard product rule, not a guideline. **`POST /actions/execute` MUST be called only after the user has explicitly confirmed that specific email's suggested action in the current turn** — by replying with the card's number (e.g. `1`) or `create 1`. The skill must refuse to bulk-execute, auto-execute, or pre-execute actions, even when: - The user says "create all", "approve everything", or sends `1,2,3` - The user asks to "stop confirming" or "auto-create from now on"

Persistent Context Injection

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.
md
## Intents Identify which intent the user's message maps to and follow the matching section. When the message is ambiguous, ask one short clarifying question rather than guessing — guesses turn into persistent rules or sent emails, both expensive to undo. ### Intent: Create Rule

Persistent Context Injection

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
Content: Scanner excerpt · SKILL.md (reported line 510)May include surrounding context.
md
These principles cut across all intents. Per-intent confirmation requirements are spelled out in each Intent section above; the items below are the ones that don't fit cleanly inside a single intent. - **Mirror user intent before acting**: when interpreting a user's rule or email draft, repeat your interpretation back before saving or sending. Vague language like "important emails should go to Slack" needs to be sharpened into a concrete condition before it becomes a persistent rule. - **Keep summaries tight**: sender, subject, one-line gist. Padding makes the digest harder to scan, which defeats its purpose. - **Fail gracefully**: if an API call fails, explain in one sentence and suggest the next step (re-authorize the app, check the rule, retry, contact support). Don't dump raw error responses. - **Trust the server's analysis**: the API already provides `summary`, `intent`, `matched_rules`, and `suggested_actions`. Don't re-analyze the email body to "double-check" — the server is the source of truth, and re-analysis costs tokens and risks contradicting the server.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The setup registers automatic recurring tasks that repeatedly access Gmail and generate digests, including examples that surface message subjects and a verification code. This creates ongoing access to potentially sensitive inbox content without any explicit user-facing disclosure, consent renewal, scope minimization, or retention limits, increasing privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to read an API key from local configuration and use it for remote requests without any user-facing disclosure or consent step. This is dangerous because it silently authorizes outbound access with stored credentials, reducing transparency and increasing the risk of unintended credential use or misuse by a deceptive or over-privileged skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description explicitly instructs triggering on Chinese keywords in addition to English, but does not frame this as a user-selectable locale preference or a documented regional specialization. This is a natural-language locale policy concern because it imposes multilingual trigger behavior by default rather than offering opt-in or context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.