Security audit

Send Email

Security checks for vulnerabilities and agentic risk

Overview

This email-sending skill is mostly aligned with its purpose, but it handles email account secrets and a hardcoded default sender in ways users should review carefully before installing.

Install only if you are comfortable giving the agent SMTP credentials and letting it send emails and attachments externally. Prefer a user-owned, narrowly scoped app password or SMTP token entered through a secure secret mechanism, avoid the built-in default sender account, do not use `--no-tls`, and review recipients, attachments, and content before confirming any send.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send_email.py:287
Finding: SMTP Credentials Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/send_email.py:299
Finding: Plaintext SMTP Authentication Can Be Explicitly Enabled
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Third-Party Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
=3.4.0 ``` The installation instruction in `SKILL.md` executes: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement accepts every future `markdown` release at or above version 3.4.0. It does not specify an audited version, upper bound, package hash, or locked transitive dependency set. As a result, installation behavior can change over time without any modification to this project. A future compromised, malicious, or incompatible release could be selected automatically. Python package installation and import both execute package-controlled code, so dependency compromise can affect the local environment in which the Skill runs. No evidence was found that the currently named package is malicious. The issue is the absence of controls that ensure installations use the specific dependency artifact that was reviewed. ### Attack Path 1. A user follows the project instructions and runs `pip install -r requirements.txt`. 2. The package resolver selects the newest release satisfying `markdown>=3.4.0`. 3. A future compromised or otherwise unsafe release is downloaded because no exact version or artifact hash is enforced. 4. Package-controlled code executes during installation or when `import markdown` runs. 5. The compromised package gains the permissions of the user running the installation or email script. ### Impact Assessment A compromised dependency would execute with the privileges of the installing or invoking user. It could access email contents, SMTP credentials available to the process, readable local files, and network resources. It could also modify the Python environment. The actual impact depends on the execution account's permissions and the behavior of the select ...[truncated 28 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly tells the agent to solicit credentials for a built-in default sender account. This is dangerous because it normalizes secret collection in chat and may facilitate unauthorized use of a shared or non-user-owned mailbox, especially given the adversarial risk of hardcoded operational identities in skills.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The examples repeatedly instruct users to paste passwords, app passwords, and SMTP secrets directly into chat. In most agent systems, chat is not an appropriate secret-entry channel because prompts, transcripts, telemetry, or logs may retain those credentials and expose downstream accounts.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The example conversation demonstrates asking the user for the authorization code of the default agent mailbox, which directly trains the agent to collect and handle mailbox secrets in chat. Examples are operational guidance; here they reinforce insecure behavior and make accidental credential exfiltration more likely.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This second example repeats the insecure pattern of requesting the authorization code for the default sender after gathering content. Repetition across examples increases the likelihood the behavior is implemented consistently and exposes users to credential theft or misuse at scale.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 76% confidence
Finding: The skill advertises capabilities that can read local files for attachments/templates but does not declare any tool scope or permissions boundaries. In an agent environment, this weakens reviewability and can enable unintended file access when the skill is invoked with user-supplied paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill omits a clear warning that email content and attachments are transmitted to external SMTP providers and recipients. Users may unknowingly send sensitive local files or confidential data outside the current system boundary.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation directs the agent to default to a built-in sender address and then ask the user for credentials for that mailbox, implying operation of an account the user may not control. This can lead to credential harvesting, unauthorized account use, or users being tricked into supplying secrets for a third-party mailbox.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 82% confidence
Finding: The instruction to automatically choose a sender identity without asking the user creates unauthorized autonomous decision-making for an externally visible action. In this context, the autonomy is more dangerous because it combines with a hardcoded mailbox and can cause emails to be sent from an unexpected identity or pressure users into providing credentials for that identity.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
**IMPORTANT - Default Sender Email Behavior**: **If the user does NOT specify a sender email in their initial request, AUTOMATICALLY use `agent_skill_test@126.com` as the default sender. DO NOT ask the user which email to send from.** Only ask the user for a different sender email if they explicitly mention wanting to use their own email address.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs collection of highly sensitive passwords, app passwords, API keys, and authorization codes without warning users about the sensitivity of those secrets or safer handling practices. In a chat-based agent context, prompting users to paste credentials directly is especially dangerous because transcripts may be logged, retained, or exposed to other components.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Earlier guidance says that if the user does not specify a sender email, the skill must automatically use agent_skill_test@126.com and must not ask which email to send from. In Example 1, the user omits the sender, but the skill asks for a sender email anyway, directly conflicting with the documented interaction policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Examples 2 and 3 switch the assistant's interaction entirely into Chinese, but the document does not state that language selection is user-driven or optional. This can violate language/locale policy when a skill implicitly forces a language rather than explicitly matching or offering the user's preference.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency is specified as markdown>=3.4.0, which allows any newer release to be installed and makes builds non-reproducible. This increases supply-chain risk and can silently pull in vulnerable or incompatible versions over time, especially relevant in a skill that may process untrusted email/template content.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
# Email sending dependencies markdown>=3.4.0

Unverifiable Dependency: markdown has 2 known advisory(ies) (CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The manifest references markdown without pinning to a specific version, while known advisories exist for some releases. Because the installed version is unconstrained above 3.4.0, the environment may resolve to an affected release, which is more concerning here because markdown processing in an email-sending skill could be exposed to untrusted template or message content and trigger denial-of-service or parsing issues.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.