ClawHub
Back to skill

Security audit

Imap Smtp Email

Security checks across malware telemetry and agentic risk

Overview

This email skill appears purpose-aligned, but its setup and credential handling create enough risk that users should review it carefully before installing.

Install only if you are comfortable giving this skill access to your email account and local files you explicitly ask it to attach or save. Review the setup script before running it, avoid migrating from any untrusted legacy .env file, keep the config file permissions restrictive, verify recipients and attachment paths before sending, and prefer a dedicated app password or throwaway mailbox over your primary email credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly requires environment variables, network access, and shell execution (`bash setup.sh`, `npm install`, IMAP/SMTP connectivity), yet it does not declare permissions accordingly. This creates a transparency and consent problem: users may install or invoke the skill without realizing it can access credentials, execute local commands, and communicate with external servers.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose understates several security-relevant behaviors: writing attachments to disk, reading arbitrary local files for body/subject/attachments, listing configured accounts, enumerating mailboxes, and performing interactive credential setup/migration into `~/.config`. These behaviors materially expand the data-access and persistence surface beyond simple 'read and send email,' increasing the risk of accidental credential exposure, local file exfiltration, or user surprise.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill facilitates transmission of email bodies and attachments to external mail servers and recipients, and also stores downloaded content locally, but the documentation does not clearly warn about privacy and data-disclosure consequences. In an email tool this behavior is expected, but the absence of explicit disclosure increases the chance users will unintentionally send or persist sensitive data.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The migration flow executes the legacy .env file with `source`, which treats its contents as shell code rather than inert configuration. If that file is modified by an attacker or contains command substitutions, arbitrary commands will run during setup under the user's privileges, and there is no warning to the user that code from the old config will be executed.

Credential Access

High
Category
Privilege Escalation
Content
// Config file locations
const LEGACY_ENV_PATH = path.join(os.homedir(), '.config', 'imap-smtp-email', '.env');
const SHARED_ENV_PATH = path.join(os.homedir(), '.config', 'mail-skills', '.env');
const FALLBACK_ENV_PATH = path.resolve(__dirname, '../.env');

function findEnvPath() {
  if (fs.existsSync(LEGACY_ENV_PATH)) return { path: LEGACY_ENV_PATH, type: 'legacy' };
Confidence
91% confidence
Finding
.env'

Credential Access

High
Category
Privilege Escalation
Content
# --- Migration logic ---
if [ "$MIGRATE" = true ]; then
  # Source the legacy .env to get variables
  set -a
  source "$LEGACY_CONFIG_FILE" 2>/dev/null
  set +a
Confidence
98% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
"search": "node scripts/imap.js search"
  },
  "dependencies": {
    "dotenv": "^16.6.1",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
Confidence
92% confidence
Finding
"dotenv": "^16.6.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "dotenv": "^16.6.1",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
    "nodemailer": "^7.0.13"
Confidence
92% confidence
Finding
"imap": "^0.8.19"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "dotenv": "^16.6.1",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
    "nodemailer": "^7.0.13"
  },
Confidence
92% confidence
Finding
"imap-simple": "^5.1.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dotenv": "^16.6.1",
    "imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
    "nodemailer": "^7.0.13"
  },
  "keywords": [
Confidence
90% confidence
Finding
"mailparser": "^3.9.3"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"imap": "^0.8.19",
    "imap-simple": "^5.1.0",
    "mailparser": "^3.9.3",
    "nodemailer": "^7.0.13"
  },
  "keywords": [
    "imap",
Confidence
97% confidence
Finding
"nodemailer": "^7.0.13"

Known Vulnerable Dependency: nodemailer==7.0.13 — 6 advisory(ies): GHSA-268h-hp4c-crq3 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-c7w3-x93f-qmm8 (Nodemailer has SMTP command injection due to unsanitized `envelope.size` paramet); GHSA-p6gq-j5cr-w38f (Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess) +3 more

High
Category
Supply Chain
Confidence
99% confidence
Finding
nodemailer==7.0.13

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.