Imap Smtp Email.Manual Backup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This email skill does what it claims, but it combines private mailbox access and sending authority with overbroad activation rules and unsafe attachment handling.

Install only if you are comfortable granting the skill access to read and send mail for the configured account. Use a revocable app password, restrict .env permissions, avoid invoking it for ambiguous message requests, do not download untrusted attachments until filename handling is fixed, and update the vulnerable mail dependencies before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3

Finding

Overbroad Skill Activation Can Trigger Email Access for Unrelated Requests

Content

View full analysis

'. To send an email: exec 'node scripts/smtp.js send --to --subject --body '. Use this skill for ANY request mentioning email, inbox, mail, messages, or unread. Always run commands with workdir set to the skill directory above. ``` ### Technical Analysis The instruction requires the agent to use this Skill for any request containing broad terms such as `messages` or `unread`. These terms are not specific to email and can occur in requests involving chat messages, application notifications, log messages, or unrelated content. Because the Skill has access to email credentials and supports reading email, modifying message flags, downloading attachments, and sending email, activating it for ambiguous requests violates least-privilege routing principles. The declared functionality only requires activation when the user explicitly requests an email operation. ### Attack Path 1. A user or untrusted prompt contains a generic phrase such as “check the unread messages.” 2. The Skill instruction directs the agent to select this email Skill without establishing that the request concerns email. 3. The agent may execute an IMAP command and expose mailbox metadata or content. 4. If the ambiguous request is interpreted as a state-changing operation, the agent may also modify message flags, download content, or send email. ### Impact Assessment The issue does not independently bypass operating-system permissions ...[truncated 405 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/imap.js:309

Finding

Untrusted Attachment Filename Can Escape the Download Directory

Content

View full analysis

--dir ``` 4. `simpleParser()` exposes the attacker-controlled filename as `attachment.filename`. 5. `path.join(outputDir, attachment.filename)` resolves the traversal path outside the intended directory. 6. ` ...[truncated 886 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.sh:125

Finding

Email Credentials Are Written Without Enforced Restrictive File Permissions

Content

View full analysis

.env << EOF # IMAP Configuration IMAP_HOST=$IMAP_HOST IMAP_PORT=$IMAP_PORT IMAP_USER=$EMAIL IMAP_PASS=$PASSWORD IMAP_TLS=$IMAP_TLS IMAP_REJECT_UNAUTHORIZED=$REJECT_UNAUTHORIZED IMAP_MAILBOX=INBOX # SMTP Configuration SMTP_HOST=$SMTP_HOST SMTP_PORT=$SMTP_PORT SMTP_SECURE=$SMTP_SECURE SMTP_USER=$EMAIL SMTP_PASS=$PASSWORD SMTP_FROM=$EMAIL SMTP_REJECT_UNAUTHORIZED=$REJECT_UNAUTHORIZED EOF ``` ### Technical Analysis The setup script writes the IMAP and SMTP secrets to a plaintext `.env` file but does not set a restrictive `umask` or explicitly apply mode `0600`. The resulting permissions therefore depend on the environment from which the script is executed. The same credential is stored twice as `IMAP_PASS` and `SMTP_PASS`. Although plaintext environment files are common for local tools, credentials granting access to private email require strict access controls. The documentation recommends adding `.env` to `.gitignore`, but the audited project does not include a `.gitignore` enforcing that protection. The password prompt uses `read -s`, which protects terminal display, but this does not protect the resulting file from local readers, backups, artifact collection, or accidental source-control inclusion. ### Attack Path 1. A user executes `setup.sh` in an environment with a permissive default umask. 2. The script creates `.env` with permissions inherited from that environment. 3. Another local account, process, backup tool, or artifact collector obtains a ...[truncated 848 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: fetch_emails.js:46

Finding

Undocumented Helper Fetches Every Full Message Body from the Inbox

Content

View full analysis

{ let buffer = ''; msg.on('body', (stream, info) => { stream.on('data', (chunk) => buffer += chunk.toString('utf8')); }); msg.once('attributes', (attrs) => { msg.once('end', async () => { try { const parsed = await simpleParser(buffer); results.push({ uid: attrs.uid, from: parsed.from?.text || 'Unknown', subject: parsed.subject || '(no subject)', date: parsed.date, snippet: parsed.text ? parsed.text.slice(0, 400) : '' }); } catch (e) { results.push({error: e.message}); } processed++; if (processed >= box.messages.total) { console.log(JSON.stringify(results, null, 2)); ``` ### Technical Analysis The IMAP range `1:*` requests every message in `INBOX`, and `bodies: ['']` retrieves each complete raw message. The script only retains a 400-character text snippet, so downloading and parsing full messages—including MIME parts and attachments—is unnecessary for its output. Unlike the documented `check` and `search` commands, this helper has no user-configurable limit, date range, sender filter, or subject filter. It accumulates all results in memory and prints mailbox-derived content to standard output. The behavior exceeds the minimum access needed for a recent-email summary and increases both privacy and availability risk. ### Attack Path 1. The helper is invoked with valid IMAP credentials. 2. It opens `INBOX` and requests the full body of every message using the range `1:*`. 3. Complete messages are buffered and parsed. 4. Sender information, subjects, dates, and messa ...[truncated 1036 chars]

Remediation

View remediation

other

Note

• Location: output.txt:1

Finding

Packaged Output File Discloses Private Mailbox Subject Metadata

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (46)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly says to use it for ANY request mentioning email, inbox, mail, messages, or unread, which is an overbroad activation rule that can capture ordinary conversation rather than clear user intent to access or send email. In this context, accidental invocation is especially dangerous because the skill can read mailbox contents and send outbound messages, creating confidentiality and integrity risks from ambiguous prompts.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · check_allmail.js (reported line 4)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · fetch_allmail.js (reported line 5)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · fetch_emails.js (reported line 5)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/imap.js (reported line 13)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/smtp.js (reported line 11)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/smtp.js (reported line 51)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Known Vulnerable Dependency: linkify-it==5.0.0 — 2 advisory(ies): CVE-2026-48801 (LinkifyIt#match scan loop has quadratic algorithmic complexity); CVE-2026-59887 (linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on at)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile pins linkify-it 5.0.0, which is reported as vulnerable to quadratic-complexity denial-of-service conditions during link scanning, including mailto parsing. In an email-processing skill, untrusted message bodies are a natural input source, so a crafted email could trigger excessive CPU usage during parsing or text conversion and degrade availability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==7.0.13 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The project depends on nodemailer 7.0.13, which has multiple published advisories including CRLF/header injection and denial-of-service conditions. This is especially relevant in a skill that sends and parses email, because attacker-controlled addresses, headers, message content, or attachments may flow into nodemailer operations and could enable spoofed headers, unauthorized content inclusion, or service disruption if not strictly validated.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: semver==5.3.0 — 1 advisory(ies): CVE-2022-25883 (semver vulnerable to Regular Expression Denial of Service)

High

• Category: Supply Chain
• Confidence: 82% confidence

Finding

The lockfile includes semver 5.3.0, which is affected by a regular-expression denial-of-service issue. In this package set it appears as a transitive dependency of utf7 rather than a primary email-handling library, so exploitability depends on whether attacker-controlled version-like strings ever reach semver parsing; the direct security relevance is lower than the mail-related dependencies but still real.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==7.0.13 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This package depends on nodemailer 7.0.13, which is flagged with multiple known advisories including header injection, denial-of-service, and content resolution bypass issues. In an email skill, this context increases danger because the package likely processes untrusted email addresses, headers, and message content, making vulnerable mail handling code directly security-relevant.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The script explicitly loads credentials from a skill-local .env file and then uses them to connect to an IMAP mailbox and read messages. In an agent skill, embedding or auto-loading a mailbox credential source enables credential use and mailbox access without strong runtime disclosure or access controls, increasing the chance of unauthorized data access if the skill is invoked unexpectedly or the .env file is exposed.

Content

Scanner excerpt · scripts/check_emails.js (reported line 4)May include surrounding context.

js

const Imap = require('imap');
const { simpleParser } = require('mailparser');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.agents', 'skills', 'imap-smtp-email', '.env') });

const config = {
  user: process.env.IMAP_USER,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · check_allmail.js (reported line 12)May include surrounding context.

js

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · fetch_allmail.js (reported line 13)May include surrounding context.

js

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · fetch_emails.js (reported line 13)May include surrounding context.

js

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 9)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 136)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: fetch_allmail.js:7

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: fetch_emails.js:7

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/check_emails.js:7

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/imap.js:23