Security audit

Exmail MCP Setup

Security checks for vulnerabilities and agentic risk

Overview

This email connector needs Review because it is presented as read/search-only but also sends email and disables important connection security checks.

Install only after treating it as a send-capable enterprise mailbox connector, not a read-only reader. Before use, remove or explicitly disclose the send_email tool, restore TLS certificate verification, avoid plaintext credential storage where possible, pin dependencies, and rotate any auth code used with the insecure TLS configuration.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/index.js:73
Finding: Undeclared outbound email capability exceeds the Skill's stated privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/index.js:23
Finding: TLS certificate verification is disabled for mailbox connections
Content: View full analysis
", "EMAIL_PASSWORD": "", "NODE_OPTIONS": "", "NODE_TLS_REJECT_UNAUTHORIZED": "0" } ``` The server independently disables certificate validation for both IMAP and SMTP: ```javascript const IMAP_CONFIG = { user: EMAIL_USER, password: EMAIL_PASSWORD, host: 'imap.exmail.qq.com', port: 993, tls: true, tlsOptions: { rejectUnauthorized: false }, }; const SMTP_CONFIG = { host: 'smtp.exmail.qq.com', port: 465, secure: true, auth: { user: EMAIL_USER, pass: EMAIL_PASSWORD }, tls: { rejectUnauthorized: false }, }; ``` ### Technical Analysis TLS encryption is not sufficient when the peer certificate is not authenticated. `NODE_TLS_REJECT_UNAUTHORIZED=0` disables certificate validation globally within the process, while `rejectUnauthorized: false` explicitly disables it in each mail client. These settings cause the connector to accept certificates that are self-signed, expired, issued for another host, or supplied by an active attacker. The duplication also means that removing only the environment variable would not restore secure validation. ### Attack Path 1. The connector starts with global and client-specific certificate validation disabled. 2. An attacker obtains a network interception position through malicious Wi-Fi, DNS manipulation, proxy control, local-network compromise, or routing manipulation. 3. The attacker presents an arbitrary TLS certificate while impersonating an Exmail endpoint. 4. The connector accepts the certificate without validating its issuer or hostname. 5. Authentication credentials and mailbox traffic can be intercepted; outbound message data may also be observed or manip ...[truncated 421 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:61
Finding: Mailbox authentication secret is persisted in plaintext MCP configuration
Content: View full analysis
", "EMAIL_PASSWORD": "", "NODE_OPTIONS": "", "NODE_TLS_REJECT_UNAUTHORIZED": "0" } } } } ``` ### Technical Analysis Environment injection through a configuration file is operationally convenient, but the secret remains stored as recoverable plaintext. The instructions do not require restrictive permissions, verify ownership, use an operating-system credential manager, or prevent the file from entering backups and diagnostic bundles. Reading `~/.workbuddy/mcp.json` before updating it is reasonably necessary to preserve existing server entries. The excessive-risk behavior is persisting a mailbox credential in that shared file without dedicated secret protection. ### Attack Path 1. The user supplies a client-specific mailbox password. 2. The setup process writes it directly into `~/.workbuddy/mcp.json`. 3. Another local user, process, extension, backup system, synchronization service, or support-bundle collector gains read access to the file. 4. The plaintext credential is extracted. 5. The attacker authenticates to supported Exmail services until the credential is revoked. ### Impact Assessment Exposure can grant access to the user's enterprise mailbox within the permissions of the auth code. Depending on service-side scope, this may include reading sensitive messages and sending email as the user. Compromise also exposes organizational contacts, business ...[truncated 60 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:50
Finding: Runtime dependencies are installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/index.js:147
Finding: IMAP sequence numbers are mislabeled and reused as stable message UIDs
Content: View full analysis
{ msg.on('body', (stream) => { let buffer = ''; stream.on('data', (chunk) => { buffer += chunk.toString('utf8'); }); stream.once('end', () => { simpleParser(buffer, (err, mail) => { if (!err) { emails.push({ uid: seqno, date: mail.date, from: mail.from?.text || '', to: mail.to?.text || '', subject: mail.subject || '(无主题)', text: (mail.text || '').substring(0, 500), }); } }); }); }); }); ``` The content operation later treats the supplied value as the identifier to fetch: ```javascript function getEmailContent(uid, mailbox) { return new Promise((resolve, reject) => { const imap = new Imap(IMAP_CONFIG); imap.once('ready', () => { imap.openBox(mailbox, false, (err, box) => { if (err) return reject(err); const f = imap.fetch([uid], { bodies: '', struct: true }); f.on('message', (msg) => { msg.on('body', (stream) => { let buffer = ''; stream.on('data', (chunk) => { buffer += chunk.toString('utf8'); }); stream.once('end', () => { simpleParser(buffer, (err, mail) => { if (err) return reject(err); resolve({ uid, date: mail.date, from: mail.from?.text || '', to: mail.to?.text || '', cc: mail.cc?.text || '', subject: mail.subject || '(无主题)', text: mail.text || '', html: mail.html || '', attach ...[truncated 2127 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims to provide read/search access to email, but the referenced implementation reportedly includes SMTP/send capability and mailbox write/action behavior not disclosed in the description. That mismatch is dangerous because users may authorize the connector believing it is read-only when it may also send mail or perform account-affecting actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill disables TLS certificate verification and presents it as a normal fix without explaining the security consequences. Omitting that warning materially increases the likelihood that users will deploy an insecure configuration permanently, exposing credentials and email traffic to interception.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The setup directs users to set NODE_TLS_REJECT_UNAUTHORIZED=0, which disables TLS certificate validation for the connector. This allows man-in-the-middle interception of email credentials and message contents, especially dangerous for a service handling mailbox authentication and potentially sensitive corporate email.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata says the connector is for connecting exmail to read and search emails, but the tool list also exposes a send_email capability. This creates a material scope mismatch: users or orchestrators may grant access expecting read-only behavior, while the code can perform outbound actions from the mailbox account.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Outbound SMTP sending is implemented even though the stated skill purpose is limited to reading and searching email. In an agent context, unexpected send capability can be abused to exfiltrate data, impersonate the user, spam contacts, or trigger business actions from a trusted corporate mailbox.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to perform networked setup actions and handle environment-stored credentials, yet it declares no explicit tool scope or permission boundaries. This creates unnecessary ambiguity about what the skill is allowed to do and increases the chance of overbroad execution when handling sensitive email configuration.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
The `mcp-email` package on npm is broken for WorkBuddy: 1. **stdout pollution**: Contains `console.log()` calls that write to stdout, corrupting MCP's JSON-RPC protocol over stdio. MCP requires stdout to carry only JSON-RPC messages. 2. **NODE_OPTIONS conflict**: WorkBuddy's runtime sets `NODE_OPTIONS=--use-system-ca` which modern Node.js rejects, killing the process immediately. 3. **Old MCP SDK**: Uses SDK v0.6.1, incompatible with current WorkBuddy's MCP client.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instructions tell the user to place EMAIL_USER and EMAIL_PASSWORD directly into mcp.json without warning that this stores sensitive credentials in plaintext configuration. Plaintext credential storage increases the risk of accidental disclosure via backups, logs, screenshots, file sharing, or local compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code accesses sensitive credentials via EMAIL_USER and EMAIL_PASSWORD, but there is no user-facing prompt, warning comment explaining the sensitivity, or other disclosure around credential handling. For code files, access to sensitive environment variables should be disclosed unless clearly warned elsewhere in the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The getRecentEmails function connects to a remote IMAP server and retrieves message metadata and body text, which involves transmitting user mailbox data over the network. The file lacks a visible disclosure near this operation explaining that mailbox contents will be accessed and returned.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The getEmailContent function retrieves full email contents, including text, HTML, and attachment metadata, from the mail server. There is no explicit warning, prompt, or nearby documentation informing users that sensitive message content will be accessed and exposed through the tool output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Sending email without explicit warning or user confirmation is dangerous because it performs an external side effect from a trusted mailbox account. In this skill's context, the risk is amplified because the manifest suggests read/search behavior, so users may not expect outbound actions at all.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The searchEmails function queries the IMAP server and returns message metadata and excerpts, which exposes mailbox data through a network-backed operation. There is no explicit comment or user-facing notice warning that the search will access and return email content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The error message is hardcoded in Chinese, indicating a fixed language choice for user-facing output. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The listed tool descriptions and parameter descriptions are presented only in Chinese, which forces one locale for user-facing metadata. There is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-language context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The startup and error messages emitted to users are fixed in Chinese. This is a locale policy issue because the file does not offer user opt-in or explain a justified reason for enforcing a single language.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.insecure_tls_verification

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: references/index.js:16

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: references/index.js:30