Imap Smtp Email

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:16 AM UTC
• Version: 1.0.1

Overview

This email skill can read and send mail as advertised, but it needs review because it is over-eager to activate and handles credentials and attachments in risky ways.

Install only if you intentionally want an agent to access this mailbox and send mail through it. Use a dedicated app password or limited mailbox, keep TLS verification enabled, restrict .env permissions manually, avoid downloading untrusted attachments until filename handling is fixed, and require explicit user confirmation before sending messages or reading private mail.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/imap.js:308

Finding

Path Traversal Through Untrusted Email Attachment Filenames

Content

View full analysis

``` 3. `mailparser` exposes the attachment filename to `downloadAttachments()`. 4. The code joins the untrusted filename to `outputDir` without canonical containment validation. 5. `fs.writeFileSync()` writes the attachment content to the resulting path. 6. If the process has permission, an existing file outside the download directory may be overwritten. ### Impact Assessment The vulnerability provides file-write capability with the privileges of the Node.js process. The reachable s ...[truncated 502 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.sh:134

Finding

Email Credentials Stored Without Enforced Restrictive Permissions

Content

View full analysis

.env << EOF # IMAP Configuration IMAP_HOST=$IMAP_HOST IMAP_PORT=$IMAP_PORT IMAP_USER=$EMAIL IMAP_PASS=$PASSWORD IMAP_TLS=$IMAP_TLS IMAP_REJECT_UNAUTHORIZED=$REJECT_UNAUTHORIZED IMAP_MAILBOX=INBOX # SMTP Configuration SMTP_HOST=$SMTP_HOST SMTP_PORT=$SMTP_PORT SMTP_SECURE=$SMTP_SECURE SMTP_USER=$EMAIL SMTP_PASS=$PASSWORD SMTP_FROM=$EMAIL SMTP_REJECT_UNAUTHORIZED=$REJECT_UNAUTHORIZED EOF ``` ### Technical Analysis The setup script writes the mailbox password, app password, or authorization code to a plaintext `.env` file. It neither establishes a restrictive `umask` before creating the file nor explicitly changes the resulting permissions to owner-only access. The final permissions therefore depend on the caller's environment. Under a permissive umask, the credential file may be readable by other local users or processes. The same credential is stored for both IMAP and SMTP, increasing the impact of disclosure. ### Attack Path 1. A user executes `setup.sh` in an environment with a permissive umask. 2. The script creates `.env` containing `IMAP_PASS` and `SMTP_PASS`. 3. The file receives permissions that may permit access by other local principals. 4. A local attacker or unrelated process reads `.env`. 5. The exposed credential is used to authenticate to the configured IMAP or SMTP service. ### Impact Assessment A disclosed credential may allow an attacker to: - Read private mailbox contents through IMAP. - Search messages and download attachments. - Change message read/unread state. - Send messages as the victim through SMTP. - Conduct phishing or impersonation using the victim's mailbox identity. The precise scope depends on the privileges granted to the password or provider-issued app password and on local access to the generated file. ...[truncated 4 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.sh:128

Finding

Optional Certificate Validation Bypass Exposes Mail Credentials and Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

rkspace/skills/imap-smtp-email. To check inbox/recent/unread emails: exec 'node scripts/imap.js check --limit 10'. To search: exec 'node scripts/imap.js search

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger text is excessively broad: it says to use this skill for ANY request mentioning email, inbox, mail, messages, or unread. Because this skill can read inbox contents and send mail, over-invocation could cause privacy-sensitive access or outbound actions in contexts where the user did not explicitly intend to use an email-capable tool.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · check_allmail.js (reported line 4)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · fetch_allmail.js (reported line 5)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · fetch_emails.js (reported line 5)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/imap.js (reported line 13)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/smtp.js (reported line 11)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/smtp.js (reported line 51)May include surrounding context.

js

#!/usr/bin/env node
const Imap = require('imap');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.env') });

const host = process.env.IMAP_HOST || 'imap.gmail.com';
const port = parseInt(process.env.IMAP_PORT || '993', 10);

Known Vulnerable Dependency: linkify-it==5.0.0 — 2 advisory(ies): CVE-2026-48801 (LinkifyIt#match scan loop has quadratic algorithmic complexity); CVE-2026-59887 (linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on at)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile pins linkify-it 5.0.0, which is reported as vulnerable to quadratic-time parsing behavior that can be triggered by crafted input, including mailto-related scans. In an email-processing skill, untrusted message bodies and headers are likely to be parsed or transformed, so this can enable remote denial of service through CPU exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==7.0.13 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The project depends on nodemailer 7.0.13, which has multiple published advisories including header injection and denial-of-service issues. Because this skill sends and parses email, nodemailer is in a security-sensitive role where malformed recipient data, headers, or content from untrusted sources could lead to mail header manipulation, policy bypass, or service disruption.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: semver==5.3.0 — 1 advisory(ies): CVE-2022-25883 (semver vulnerable to Regular Expression Denial of Service)

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The lockfile includes semver 5.3.0, which is known to be vulnerable to Regular Expression Denial of Service. In this skill it appears as a transitive dependency under utf7 rather than a primary email-handling library, so exploitability is less direct, but it still creates avoidable risk if attacker-controlled version-like strings ever reach that code path.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==7.0.13 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package declares nodemailer 7.0.13, which is flagged with multiple published advisories including header injection, denial-of-service, and security control bypass issues. In an email skill that directly handles SMTP message composition and sending, these flaws are especially relevant because attacker-controlled email fields or content may reach the vulnerable library and enable message manipulation, abuse, or service disruption.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Loading credentials from a specific .env file inside the skill directory indicates direct credential access by the code. In a skill with no supplied metadata or declared need for mailbox administration, this increases risk because secrets may be bundled, mishandled, or silently used to access an external account.

Content

Scanner excerpt · scripts/check_emails.js (reported line 4)May include surrounding context.

js

const Imap = require('imap');
const { simpleParser } = require('mailparser');
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '.agents', 'skills', 'imap-smtp-email', '.env') });

const config = {
  user: process.env.IMAP_USER,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · check_allmail.js (reported line 12)May include surrounding context.

js

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · fetch_allmail.js (reported line 13)May include surrounding context.

js

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · fetch_emails.js (reported line 13)May include surrounding context.

js

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 9)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 158)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: fetch_allmail.js:7

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: fetch_emails.js:7

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/check_emails.js:7

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/imap.js:23