ClawHub
Back to skill

Security audit

Surface Cli

Security checks for vulnerabilities and agentic risk

Overview

This mail-management skill is purpose-aligned but needs Review because it installs an unpinned npm mail CLI that will handle mailbox credentials and messages.

Install only if you trust the Surface CLI npm package and publisher, because the CLI can access email contents and stored mailbox authentication and may send or modify mail when write safety allows it. Keep write actions disabled unless needed, prefer drafts, avoid pasting passwords into chat, and confirm any external summarizer setting before letting email content leave the local machine.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding
Unpinned High-Privilege npm Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9-18` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml "openclaw": { "emoji": "📬", "homepage": "https://github.com/VishalJ99/surface-cli", "requires": { "bins": ["surface"] }, "install": [ { "id": "node", "kind": "node", "package": "surface-cli", "bins": ["surface"], "label": "Install Surface CLI (npm)", }, ``` ### Technical Analysis The installation metadata identifies the npm package only as `surface-cli`, without an exact version, integrity hash, lockfile, or immutable release reference. Consequently, installation may resolve to mutable registry content that was not included in—or directly verifiable through—this audit. This dependency is security-sensitive because the documented CLI functionality requires access to Gmail, Outlook, and IMAP/SMTP accounts. During normal operation, the executable may process provider tokens, Outlook profile cookies, IMAP credentials, message content, attachments, recipients, and outbound messages. The skill also permits mailbox-changing operations when enabled, including sending mail, archiving messages, changing read state, and responding to invitations. The dependency is necessary for the declared mail-management functionality, but allowing any future package version exceeds the minimum supply-chain trust needed to provide that functionality. This finding does not establish that the current npm package is malicious; it identifies the absence of controls ensuring that the installed executable is the version that was reviewed. The separately flagged transmission of email content to an external summarizer is explicitly documented as optional, user-configured, and subject to user consent. Based on the reviewed file, that behavior does not independently demonstrate unauthorized exfiltration. ### Attac ...[truncated 1963 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin `surface-cli` to an exact, reviewed version instead of allowing installation of the latest available release. 2. Verify the package with an expected integrity digest or install it through a lockfile-backed workflow that records npm integrity metadata. 3. Document the expected npm publisher, repository, release tag, and artifact checksum so operators can verify package provenance. 4. Require explicit review and checksum updates before dependency upgrades. 5. Prefer an immutable, reproducibly built release artifact with provenance attestations or verified signatures where supported. 6. Run the CLI with the minimum operating-system and mailbox permissions required for the requested operation. 7. Separate read-only workflows from write-capable workflows and keep write operations disabled unless explicitly needed. 8. Restrict outbound network access to documented mail-provider and explicitly approved summarizer endpoints where operationally feasible. 9. Avoid exposing unrelated environment variables or filesystem paths to the CLI process. 10. Periodically audit the resolved package, transitive dependencies, install scripts, and published binary against the pinned source revision. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
`--password <password>` is supported and treats the flag value as the password
directly, but prefer `--password-env`, `--password-file`, or
`--password-command` because direct CLI passwords can leak through shell
history, process listings, terminal logs, or agent transcripts. Do not ask the
user to paste mailbox passwords into chat or store them in the repo.

Local policy lives in:
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium
Category
Rogue Agent
Content
inbox arrivals plus targeted `search` when the watch has narrow filters.
9. Read only the messages you need with `surface mail read <message_ref>`.
10. For passive watching, do not mutate read state. If the user explicitly asks you to triage unread
   mail and write safety is enabled, marking handled messages read after reporting is acceptable
   unless the user asks to keep them unread.
11. Act using refs from Surface output. Do not rely on array positions from previous JSON.
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.