ClawHub
Back to skill

Security audit

Skill Mail Sender

Security checks for vulnerabilities and agentic risk

Overview

This mail-sending skill does what it claims, but it needs review because it can send outbound email with stored SMTP credentials and lacks clear confirmation and secret-handling safeguards.

Review this skill carefully before installing. Use a dedicated app password or authorization code, restrict credential-file permissions, avoid shared machines, and require the agent to show the recipient list, subject, and content summary before every send, especially for default recipients or batch emails.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:2
Finding

Unpinned and Unnecessary Third-Party Dependencies Increase Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:2-3 and SKILL.md:21
Vulnerability Type: Unbounded dependency resolution and unnecessary dependency installation
Risk Level: Medium

Vulnerable Code

requirements.txt:2-3:

text
requests>=2.28.0
markdown>=3.4.0

SKILL.md:21:

bash
pip install -r requirements.txt

Technical Analysis

The installation instructions resolve dependencies using minimum-version constraints without upper bounds, exact pins, hashes, or a lock file. As a result, the effective code installed by users can change after the Skill has been reviewed.

The markdown package is imported by scripts/mail_sender.py for Markdown conversion, but requests is not imported anywhere in the reviewed implementation. Installing requests therefore expands the dependency tree and attack surface without supporting the Skill's declared functionality.

This does not demonstrate that the named packages are currently malicious. The vulnerability is that installation trusts mutable future releases and includes an unnecessary package, making builds non-reproducible and increasing exposure to package-registry or maintainer compromise.

Attack Path

  1. A user follows the documented command pip install -r requirements.txt.
  2. The package resolver selects any available release satisfying the lower-bound constraints.
  3. A compromised, malicious, or unexpectedly incompatible future release is downloaded from the configured package index.
  4. Package installation or subsequent import executes attacker-controlled package code in the context of the user running the installation or Skill.
  5. That code receives the same filesystem, environment-variable, and network privileges as the Skill process.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the privileges of the installing or invoking user. This may expose environment va ...[truncated 335 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove requests unless a reviewed code path genuinely requires it.
  2. Pin markdown to a specifically reviewed version rather than using only a minimum version.
  3. Generate and commit a reproducible lock file.
  4. Require package hashes, for example through a hash-locked requirements file and pip install --require-hashes.
  5. Review transitive dependencies and update them through a controlled dependency-update process.
  6. Install only from a trusted, explicitly configured package index.
  7. Run installation and execution in an isolated virtual environment with no unnecessary filesystem or credential access.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mail_sender.py:163
Finding

SMTP Credentials Are Loaded from Plaintext Files Without Permission or Ownership Validation

Content
View full analysis

Vulnerability Details

File Location: scripts/mail_sender.py:163-168; related plaintext .env guidance at references/config.md:257-274
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

Vulnerable Code

scripts/mail_sender.py:163-168:

python
if os.path.exists(path):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            config = json.load(f)

        # Only fill values that have not already been configured
        if not self.sender_email:
            self.sender_email = config.get('sender_email')
        if not self._sender_password:
            self._sender_password = config.get('sender_password')

Related guidance in references/config.md:257-274 directs users to place the credential in a plaintext file and source it:

env
MAIL_SENDER_EMAIL=your_email@163.com
MAIL_SENDER_PASSWORD=your_auth_code_here
MAIL_SMTP_SERVER=smtp.163.com
MAIL_SMTP_PORT=465
MAIL_DEFAULT_RECEIVERS=user1@example.com,user2@example.com
bash
source ~/.openclaw/mail-sender/.env

Technical Analysis

SMTP authentication requires access to an authorization credential, so credential access itself is necessary for the declared email-sending functionality. However, the implementation loads the authorization code directly from plaintext JSON files without verifying:

  • File ownership
  • File permissions
  • Whether the path is a symbolic link
  • Whether the containing directory is writable by another user
  • Whether the file changed between path validation and opening

The documentation recommends chmod 600 for one JSON configuration path at references/config.md:293-298, but this protection is advisory and is not enforced by the implementation. Equivalent permission guidance is not provided alongside the .env workflow.

The flagged .env path is a dedicated, user-created mail configuration file rather than an attempt to enumerat ...[truncated 2332 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer an operating-system keyring, managed secret store, or narrowly scoped runtime secret injection instead of persistent plaintext credentials.
  2. Before loading a credential file on POSIX systems, use lstat and reject symbolic links, files not owned by the current user, non-regular files, and files with group or world permissions.
  3. Require restrictive permissions such as mode 0600 for credential files and 0700 for their containing directories.
  4. Open files defensively with platform-appropriate no-follow semantics and validate the opened file descriptor to reduce symbolic-link and time-of-check/time-of-use risks.
  5. Apply the same security instructions to every supported credential format, including .env.
  6. Consolidate the documented and implemented configuration paths so users do not create duplicate secret files.
  7. Avoid broadly exporting credentials into long-lived shell sessions. Inject them only into the process that sends mail.
  8. Recommend provider-issued application authorization codes with the narrowest available permissions, and document immediate revocation and rotation procedures.
  9. Treat MAIL_CONFIG_PATH as security-sensitive and use it only in trusted execution environments.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
Findings (20)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config.md (reported line 255)May include surrounding context.

md
---

## 🌍 环境变量示例（.env 文件）

**位置**：`~/.openclaw/mail-sender/.env`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config.md (reported line 274)May include surrounding context.

md
---

## 🌍 环境变量示例（.env 文件）

**位置**：`~/.openclaw/mail-sender/.env`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config.md (reported line 305)May include surrounding context.

md
---

## 🌍 环境变量示例（.env 文件）

**位置**：`~/.openclaw/mail-sender/.env`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config.md (reported line 516)May include surrounding context.

md
---

## 🌍 环境变量示例（.env 文件）

**位置**：`~/.openclaw/mail-sender/.env`

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description is broad enough to match many ordinary requests involving notifications, reports, reminders, or email-like tasks, which increases the chance of accidental invocation. Because this skill performs outbound communication, unintended triggering could cause unauthorized data exfiltration or unwanted emails to be sent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The README recommends storing persistent SMTP credentials in a local config file under the user's home directory, creating session persistence for sensitive secrets beyond a single run. If the host is compromised, backups are exposed, or file permissions are weak, an attacker could recover the email account credentials and use them for unauthorized outbound communication.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

bash
# Linux/macOS
mkdir -p ~/.openclaw/skills/mail-sender
nano ~/.openclaw/skills/mail-sender/config.json

# Windows (PowerShell)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation demonstrates sending email as a normal operation but does not clearly warn that this is an external side effect that transmits data to third parties. In an agent setting, lack of explicit user warning and confirmation around outbound email can lead to privacy breaches, accidental disclosure, or social engineering amplification.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documentation indicates it reads environment variables and local configuration files, but it does not declare any tool scope or permissions boundaries. In an agent ecosystem, this creates an implicit capability to access sensitive local data such as SMTP credentials without clear user visibility or platform enforcement, increasing the risk of unauthorized secret access or misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation criteria are overly broad, covering essentially any email-related task including notifications, reports, reminders, and batch sends. This can cause the agent to invoke the skill in situations where external transmission of content or recipient data was not intended, increasing the chance of data leakage, phishing-style misuse, or unreviewed outbound communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill handles outbound email but does not clearly warn users that message content, recipient addresses, and possibly sender metadata will be transmitted to external SMTP infrastructure. Without this disclosure, users may provide sensitive information under the mistaken assumption that processing is local-only, making accidental exfiltration more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config.md (reported line 41)May include surrounding context.

Linux/macOS：

bash
# 创建配置目录
mkdir -p ~/.openclaw/mail-sender

# 创建配置文件
nano ~/.openclaw/mail-sender/config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config.md (reported line 297)May include surrounding context.

  1. 设置文件权限（Linux/macOS）

    bash
    chmod 600 ~/.openclaw/mail-sender/config.json

  2. 添加到 .gitignore

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This is a markdown file, so SQP-2 applies to user-facing descriptions of behaviors affecting privacy or system integrity. The testing section instructs users to send a real test email, but it does not clearly warn that doing so will transmit message contents and recipient addresses to external SMTP providers and recipients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python skill file contains its primary documentation and many user-facing messages only in Chinese, which imposes a specific language/locale on users. The policy allows locale constraints only when they are explicitly optional or clearly justified as region-specific, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

该 README 的主要说明、描述和操作指引均为中文，未说明这是面向特定中文用户群体的区域性技能，也未提供其他语言选项。按照语言/区域策略，若技能默认强制单一语言，应提供用户选择或明确的适用范围说明。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

SQP-3 applies to natural-language policy violations in all file types, including markdown. A fully Chinese-only instruction set can amount to a forced language/locale constraint when no opt-in, alternative language, or justified region-specific limitation is provided.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency specification uses a lower-bound only constraint (requests>=2.28.0) rather than pinning to a specific known-good version. This makes builds non-reproducible and can unexpectedly pull in vulnerable or incompatible releases, which is especially relevant for a mail-sending skill that may handle credentials, recipient data, and network requests.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
# requirements.txt
requests>=2.28.0
markdown>=3.4.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

requests has multiple known advisories, and because the manifest does not pin a version, there is no way to verify that deployed environments avoid affected releases. For a mail-sender skill, HTTP interactions may involve APIs, tokens, or credentials, so pulling an affected requests version could expose sensitive data or weaken transport security behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency specification for markdown is also unpinned (markdown>=3.4.0), so installations may resolve to different versions over time. In this skill, Markdown is converted to HTML for email content, so an unsafe or buggy future release could affect content handling, reliability, or security of generated output.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
# requirements.txt
requests>=2.28.0
markdown>=3.4.0

Unverifiable Dependency: markdown has 2 known advisory(ies) (CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
80% confidence
Finding

markdown has known advisories, but the manifest leaves the installed version unverifiable due to the open-ended constraint. Since this skill transforms Markdown into HTML for email delivery, a vulnerable parser could cause crashes, malformed output, or unsafe rendering behavior depending on how untrusted content is processed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.