Sog

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:52 AM UTC
• Version: 0.3.0

Overview

This appears to be a real email, calendar, contacts, tasks, and files CLI, but it needs review because it has under-documented command execution and credential-safety risks.

Install only if you are comfortable giving this tool access to the configured mail, calendar, contacts, task, and WebDAV accounts. Use keychain storage, HTTPS/TLS-only endpoints, and a pinned reviewed version; avoid --no-tls, --insecure, http:// DAV URLs, --storage file, and sog idle --exec unless you intentionally want those risks. Treat delete, clear, send, upload, move, and contact/calendar update commands as real remote account mutations.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: internal/imap/client.go:38

Finding

IMAP and SMTP credentials may be transmitted without authenticated encryption

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: internal/webdav/client.go:35

Finding

DAV Basic Authentication credentials can be sent to plaintext HTTP endpoints

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: internal/config/keyring.go:84

Finding

Optional file credential backend stores account passwords in plaintext JSON

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: internal/cli/idle.go:74

Finding

Undocumented IMAP IDLE option executes arbitrary shell commands

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Recommended installation uses a mutable remote version

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: internal/smtp/client.go:91

Finding

Unvalidated SMTP header fields permit email header injection

Content

View full analysis

0 { content.WriteString(fmt.Sprintf("Cc: %s\r\n", strings.Join(msg.Cc, ", "))) } content.WriteString(fmt.Sprintf("Subject: %s\r\n", msg.Subject)) content.WriteString("MIME-Version: 1.0\r\n") ``` ### Technical Analysis Sender, recipient, CC, and subject values are interpolated directly into SMTP message headers. The code does not reject carriage-return or line-feed characters and does not use a standards-compliant header encoder. An attacker who controls one of these CLI values can terminate the intended header and insert additional RFC 5322 headers. Depending on the injected content and downstream mail processing, this can alter message presentation, add misleading headers, or prematurely terminate the header section. SMTP envelope recipients are configured separately through `client.Rcpt`, so injecting a displayed `To`, `Cc`, or `Bcc` header does not by itself add an SMTP envelope recipient. It can, however, create deceptive message metadata or modify MIME interpretation. ### Attack Path 1. An attacker influences a mail-send invocation or supplies a subject or address containing CRLF characters. 2. The value is accepted without validation. 3. The SMTP client concatenates the value into the raw message header block. 4. The injected CRLF starts one or more attacker-selected headers or terminates the header section. 5. The receiving mail system processes the modified message structure. ### Impact Assessment The attacker may forge displayed headers, add misleading routing or reply metadata, alter MIME interpretation, or create messages that appear different from what the caller ...[truncated 144 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (68)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 80% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · CHANGELOG.md (reported line 62)May include surrounding context.

md

- `sog mail reply` — Reply to a message
- `sog mail forward` — Forward a message
- `sog mail move` — Move message to folder
- `sog mail copy` — Copy message to folder
- `sog mail flag` — Set message flag
- `sog mail unflag` — Remove message flag
- `sog mail delete` — Delete a message

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 199)May include surrounding context.

sog drive mkdir /New-Folder sog drive move /old.pdf /new.pdf sog drive copy /src.pdf /dst.pdf sog drive delete /file.pdf

text

**Alias:** `sog files` → `sog drive`

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is consistent with part of the declared domain—CalDAV calendar/task operations over open standards—but it does not reflect the full declared scope. The declared description presents a general-purpose CLI covering IMAP, SMTP, CalDAV, CardDAV, and WebDAV, whereas this specific code chunk only provides CalDAV client logic for calendars, events, and tasks. There is no evidence here of IMAP, SMTP, CardDAV, generic WebDAV, or CLI trigger/command behavior. This is a description-versus-behavior mismatch at the chunk level because the actual behavior is a narrower CalDAV library component than the declared overall skill purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The IMAP mail-watching behavior fits the general declared scope of an open-standards CLI for IMAP. However, this code also includes a significant undeclared capability: it can run an arbitrary shell command via sh -c whenever new mail arrives. That is materially broader than a normal IMAP/SMTP/CalDAV/CardDAV/WebDAV client function and introduces local code execution behavior not reflected in the description. The trigger model is also more specific than declared: it reacts to incoming mail events via IMAP IDLE. Signal handling itself is just implementation detail, but the shell execution on mail arrival is a meaningful description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad multi-protocol CLI covering IMAP, SMTP, CalDAV, CardDAV, and WebDAV. The supplied code chunk is narrowly focused on IMAP only. That is a material description-to-behavior mismatch for this chunk because the actual implemented behavior does not represent the broader stated capability set. Additionally, the code is not just passive access; it performs full mailbox management operations including mutation and deletion of messages and folders, plus draft creation and IDLE monitoring. While these are related to IMAP and may fit within a larger standards-ops tool, they are more specific and powerful than the high-level description suggests. No evidence in this chunk supports SMTP, CalDAV, CardDAV, or WebDAV behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md

type Config struct {
	Accounts       map[string]Account `json:"accounts"`
	DefaultAccount string             `json:"default_account,omitempty"`
	Storage        string             `json:"storage,omitempty"` // keychain or file
	path           string
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

type Config struct {
	Accounts       map[string]Account `json:"accounts"`
	DefaultAccount string             `json:"default_account,omitempty"`
	Storage        string             `json:"storage,omitempty"` // keychain or file
	path           string
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/cli/auth.go (reported line 35)May include surrounding context.

go

type Config struct {
	Accounts       map[string]Account `json:"accounts"`
	DefaultAccount string             `json:"default_account,omitempty"`
	Storage        string             `json:"storage,omitempty"` // keychain or file
	path           string
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/cli/root.go (reported line 78)May include surrounding context.

go

type Config struct {
	Accounts       map[string]Account `json:"accounts"`
	DefaultAccount string             `json:"default_account,omitempty"`
	Storage        string             `json:"storage,omitempty"` // keychain or file
	path           string
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 15)May include surrounding context.

go

type Config struct {
	Accounts       map[string]Account `json:"accounts"`
	DefaultAccount string             `json:"default_account,omitempty"`
	Storage        string             `json:"storage,omitempty"` // keychain or file
	path           string
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/keyring.go (reported line 19)May include surrounding context.

go

type Config struct {
	Accounts       map[string]Account `json:"accounts"`
	DefaultAccount string             `json:"default_account,omitempty"`
	Storage        string             `json:"storage,omitempty"` // keychain or file
	path           string
}

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · internal/config/config.go (reported line 142)May include surrounding context.

go

c.DefaultAccount = acct.Email
	}

	// Store password in keyring
	if err := SetPassword(acct.Email, password); err != nil {
		return fmt.Errorf("failed to store password: %w", err)
	}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/cli/auth.go (reported line 84)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 142)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 186)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config_test.go (reported line 49)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/keyring.go (reported line 10)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/keyring.go (reported line 118)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/keyring.go (reported line 120)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/keyring.go (reported line 168)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/keyring.go (reported line 170)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/keyring.go (reported line 218)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/keyring.go (reported line 220)May include surrounding context.

go

"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const serviceName = "sog"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/cli/auth.go (reported line 44)May include surrounding context.

go

type StorageType string

const (
	StorageKeyring StorageType = "keychain"
	StorageFile    StorageType = "file"
)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · internal/config/config.go (reported line 104)May include surrounding context.

go

type StorageType string

const (
	StorageKeyring StorageType = "keychain"
	StorageFile    StorageType = "file"
)

Static analysis

No suspicious patterns detected.