Imap Smtp Email.Disabled

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

This email skill mostly does what it says, but it handles full mailbox credentials and outbound email with important safety gaps around SMTP TLS and file write boundaries.

Review this before installing if you plan to use a real mailbox. Prefer provider app passwords or scoped credentials, keep .env out of version control, do not disable certificate verification unless you understand the risk, avoid sending sensitive attachments, and restrict ALLOWED_READ_DIRS and ALLOWED_WRITE_DIRS to narrow directories you control.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/smtp.js:60

Finding

SMTP Credentials and Message Data Can Be Transmitted Without Mandatory TLS

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/imap.js:16

Finding

Attachment Write Whitelist Can Be Bypassed Through Symlinked Directories

Content

View full analysis

path.resolve(d.trim().replace(/^~/, os.homedir())) ); const allowed = allowedDirs.some(dir => resolved === dir || resolved.startsWith(dir + path.sep) ); if (!allowed) { throw new Error(`Access denied: '${dirPath}' is outside allowed write directories`); } return resolved; } ``` The validated path is subsequently used for attachment writes: ```js // Create output directory if it doesn't exist const resolvedDir = validateWritePath(outputDir); if (!fs.existsSync(resolvedDir)) { fs.mkdirSync(resolvedDir, { recursive: true }); } const downloaded = []; for (const attachment of parsed.attachments) { // If specificFilename is provided, only download matching attachment if (specificFilename && attachment.filename !== specificFilename) { continue; } if (attachment.content) { const filePath = path.join(resolvedDir, sanitizeFilename(attachment.filename)); fs.writeFileSync(filePath, attachment.content); downloaded.push({ filename: attachment.filename, path: filePath, size: attachment.size, }); } } ``` ### Technical Analysis `validateWritePath` performs only lexical normalization with `path.resolve`. It does not canonicalize the destination using `fs.realpathSync` and does not inspect path components for symbolic links. Consequently, a path can appear lexically beneath an allowed directory while ...[truncated 2013 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/smtp.js:14

Finding

Attachment Read Validation Is Vulnerable to a Symlink TOCTOU Race

Content

View full analysis

path.resolve(d.trim().replace(/^~/, os.homedir())) ); const allowed = allowedDirs.some(dir => realPath === dir || realPath.startsWith(dir + path.sep) ); if (!allowed) { throw new Error(`Access denied: '${inputPath}' is outside allowed read directories`); } return realPath; } ``` The canonical path returned by validation is discarded: ```js // Read file content for attachments function readAttachment(filePath) { validateReadPath(filePath); if (!fs.existsSync(filePath)) { throw new Error(`Attachment file not found: ${filePath}`); } return { filename: path.basename(filePath), path: path.resolve(filePath), }; } ``` ### Technical Analysis `validateReadPath` resolves a file's canonical location and returns it. However, `readAttachment` ignores that return value and gives Nodemailer the original lexically resolved path. Validation and file opening occur at different times. A local attacker who can modify the selected file or a symlink in an allowed directory can replace it after validation but before Nodemailer opens it. Nodemailer may then read a different file from the one that passed the whitelist check. The `fs.existsSync` call does not prevent the race and introduces another separate check before use. Similar file-based subject and body operations validate and then reop ...[truncated 1594 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The implemented functionality substantially matches the read/search/fetch/mark/list/download portions of the description, but the declared description explicitly includes 'send email via IMAP/SMTP' and 'send emails with attachments.' This code chunk contains no SMTP logic, no mail composition, and no send operation. It also includes mailbox listing and attachment download-to-disk behavior, which are adjacent email-management features; these are not problematic undeclared capabilities in context. The primary mismatch is that a significant declared capability—outbound email sending—is absent from the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a full IMAP/SMTP email skill with both inbound mail access and outbound sending. However, this code chunk is limited to SMTP send/test operations using nodemailer. It creates an SMTP transporter, verifies connectivity, sends mail, and reads local files for composing messages and attachments. There is no code for connecting to an IMAP server, listing/searching messages, reading mailbox contents, or changing message flags. Therefore the implementation materially underdelivers on the declared behavior, making the description inaccurate for this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/imap.js (reported line 14)May include surrounding context.

js

const path = require('path');
const os = require('os');
const fs = require('fs');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });

function validateReadPath(inputPath) {
  let realPath;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/smtp.js (reported line 13)May include surrounding context.

js

const path = require('path');
const os = require('os');
const fs = require('fs');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });

function validateReadPath(inputPath) {
  let realPath;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/smtp.js (reported line 81)May include surrounding context.

js

const path = require('path');
const os = require('os');
const fs = require('fs');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });

function validateReadPath(inputPath) {
  let realPath;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 9)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 169)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 170)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.sh (reported line 171)May include surrounding context.

sh

echo "  IMAP/SMTP Email Skill Setup"
echo "================================"
echo ""
echo "This script will help you create a .env file with your email credentials."
echo ""

# Prompt for email provider

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

At this point the script begins writing a .env file that includes IMAP and SMTP credentials, resulting in persistent plaintext storage of authentication secrets. In the context of an email skill, those credentials grant broad mailbox access and sending capability, making compromise more sensitive than ordinary app configuration.

Content

Scanner excerpt · setup.sh (reported line 143)May include surrounding context.

sh

read -p "Allowed directories for reading files (comma-separated, e.g. ~/Downloads,~/Documents): " ALLOWED_READ_DIRS
read -p "Allowed directories for saving attachments (comma-separated, e.g. ~/Downloads): " ALLOWED_WRITE_DIRS

# Create .env file
cat > .env << EOF
# IMAP Configuration
IMAP_HOST=$IMAP_HOST

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This finding is effectively the same credential-storage issue: the heredoc writes configuration that includes email account secrets into .env. Because these are live mailbox credentials, exposure could allow reading mail, sending mail as the user, and accessing sensitive attachments or reset links.

Content

Scanner excerpt · setup.sh (reported line 144)May include surrounding context.

sh

read -p "Allowed directories for saving attachments (comma-separated, e.g. ~/Downloads): " ALLOWED_WRITE_DIRS

# Create .env file
cat > .env << EOF
# IMAP Configuration
IMAP_HOST=$IMAP_HOST
IMAP_PORT=$IMAP_PORT

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill requires environment variables, invokes shell commands via Node/NPM, and performs network access to IMAP/SMTP servers, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the skill's effective capabilities broader and less transparent to users or policy engines, increasing the risk of unintended credential use, external data exfiltration, or unauthorized email actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill can transmit email contents and attachments to external servers and download attachments locally, but the user-facing description lacks an explicit privacy and external-action warning. In this context, that matters because the skill handles highly sensitive data and can cause outbound communication, making accidental disclosure or unsafe use more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code builds an IMAP connection using IMAP_USER and IMAP_PASS and then connects to the configured host, which necessarily transmits credentials and email access over the network. While the file has a high-level docstring, it does not visibly warn the user in code that their mailbox credentials and message data will be sent to a remote IMAP server.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The download command creates directories and writes attachment content to the local filesystem, which can affect user data and storage state. Although the function name and command imply downloading, the code does not provide a visible warning, confirmation, or explicit user disclosure when performing these file writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code reads sensitive SMTP credentials from environment variables and uses them to establish an outbound SMTP connection that can transmit message content and attachments. Although the file has a high-level docstring describing email sending, it does not clearly warn users that credentials will be used and that message data will be transmitted to an external SMTP server.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill reads local files for attachments and email content, then includes that data in outbound email messages. While file path restrictions are enforced, there is no explicit disclosure in the user-facing usage/help or runtime output that selected files will be read and their contents may be sent externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The test command is presented as a connection check, but it also sends a real email to SMTP_USER. That side effect can trigger unintended outbound communication, leak that the account is active, and surprise users or automation that expected a non-invasive health check.

Content

No source excerpt is available for this finding.