T08 · Insecure Dependencies
Warning
- Location
SKILL.md:9- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Alimail Manager
Security checks for vulnerabilities and agentic risk
Overview
This AliMail skill is coherent and not deceptive, but it handles organization mailbox data and credentials with under-scoped permissions and weak privacy safeguards.
Review before installing. Use this only with an authorized AliMail application, grant read-only least-privilege scopes, avoid read-write scopes for these scripts, pin and review the npm dependency, and treat terminal output as sensitive because it may include user profile data and full email content.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/alimail-api.md:38- Finding
Read-Only Skill Documentation Permits Excessive Organization-Wide Write Access
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is designed to retrieve user information, message contents, and search mailbox data, yet it provides no warning about the sensitivity of mailbox content, privacy implications, or the handling of OAuth client credentials. Because email bodies and account metadata often contain confidential or regulated information, missing warnings and safeguards materially increase the risk of privacy violations and credential misuse.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 获取用户信息：调用 `scripts/get_user.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 获取用户信息：调用 `scripts/get_user.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 获取邮件详情：调用 `scripts/get_message.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 获取邮件详情：调用 `scripts/get_message.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 搜索邮件：调用 `scripts/search_messages.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 搜索邮件：调用 `scripts/search_messages.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 搜索邮件：调用 `scripts/search_messages.js`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README documents capabilities to query user information, retrieve specific email content, and search mailboxes, and it instructs operators to configure application credentials, but it provides no privacy, authorization, or data-handling warnings. In a mailbox-management skill, this omission is security-relevant because it normalizes access to highly sensitive communications and personal data without emphasizing least privilege, legal basis, auditability, or consent requirements.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill requires sensitive environment variables (
ALMAIL_APP_ID,ALMAIL_SECRET) and invokes local scripts, but it does not declare an explicit tool scope such as permitted environment access or allowed tools. That omission weakens containment and reviewability, making it easier for an agent runtime to grant broader-than-necessary access when handling mailbox data and credentials.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger conditions are broad enough that the skill may activate whenever a user mentions enterprise mail users or messages, without clear boundaries, consent checks, or authorization requirements. In a mailbox-management context, overbroad activation increases the chance of unnecessary access to sensitive user records and email content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document promotes OAuth2 client_credentials with powerful application-wide scopes such as User.Read.All and Mail.Read.All / Mail.ReadWrite.All, yet omits guidance on secure secret storage, token handling, rotation, and the risks of non-user-scoped access. Because client_credentials often grants broad unattended access across many users, poor credential hygiene or overbroad scope assignment could expose the entire organization's mailbox and directory data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document describes APIs that can read highly sensitive enterprise data, including user profile details and full email contents, but provides no warning about privacy, consent, access control, or audit expectations. In a skill that enables mailbox lookup and message retrieval, this omission can normalize broad data access and increase the likelihood of over-collection, unauthorized review of employee mail, or use beyond legitimate business need.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This script fetches a message by email address and message ID, then prints the full returned object to stdout. In the context of an email-management skill, that can expose sensitive mail content, headers, recipients, and other private data into terminal history, logs, or upstream agent outputs without any masking, confirmation step, or safe default field restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script retrieves mailbox user information and prints the full returned object directly to stdout, which can expose personally identifiable information or administrative metadata in logs, terminals, CI output, or agent transcripts. In the context of an email-management skill, this is more dangerous because the data source is enterprise email account information, which is often sensitive even when access is authorized.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code performs a networked mailbox search via
client.searchMessages(params.email, options), sending the user's email address and query to an external mail service. Although the script logs that it is searching mail, it does not provide any user-facing warning or disclosure about transmitting mailbox-related data to a remote service or accessing potentially sensitive message metadata.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The natural-language documentation is entirely in Chinese and does not provide an alternative language option or indicate that the skill is intended only for a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a single language without user opt-in can be a policy concern when no justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language strings in comments and error messages are exclusively in Chinese, including the usage description and user-facing error text. The policy explicitly flags language or locale constraints when a skill forces a specific language without user opt-in, and this file does not offer any alternative language or explain that it is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language documentation and console messages in this file are written entirely in Chinese, which imposes a specific language on users without any opt-in or stated locale requirement. This can violate language or locale policy when skills are expected to be usable without forcing a single language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The natural-language instructions, parameter descriptions, and examples are presented exclusively in Chinese. This can violate a language or locale policy when a skill forces a specific language without user opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content in comments, usage text, status output, and error messages is entirely in Chinese, which imposes a specific language on users without opt-in or an alternative. Under the stated policy, forcing a language or locale without user choice is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.