T09 · Insecure Skill Coding Practices
Warning
- Location
config.toml:3- Finding
Mailbox Credentials Stored in Plaintext Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
China Telecom Mail
Security checks for vulnerabilities and agentic risk
Overview
This mail skill mostly matches its stated purpose, but it can read mailbox contents, send or forward mail with arbitrary local attachments, and stores mailbox credentials in a plain config file.
Review before installing. Use it only with a China Telecom mailbox you control, prefer a revocable mail authorization code over a primary password, restrict config.toml permissions, and require explicit user confirmation before any send, forward, or attachment action. Do not allow untrusted email content or prompts to choose recipients or file paths.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README materially understates the skill's capabilities by describing it as a read-only POP3 email reader, while the skill metadata says it can also send and forward mail via SMTP. This can mislead users and reviewers about the trust boundary and permissions of the skill, increasing the risk of accidental deployment of a tool with outbound email capability and potential data exfiltration or misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file contains substantial user-facing instructions in Chinese, including setup, usage, feature descriptions, and troubleshooting, while other parts are in English. This effectively imposes a language requirement on users without opt-in or an explicit statement that the skill is intended only for Chinese-speaking or region-specific users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly handles highly sensitive email data but the description does not warn users that message subjects, bodies, metadata, and potentially attachments will be accessed and exposed through the tool. This can lead users to invoke the skill without understanding the privacy implications, increasing the risk of unintended disclosure of personal, corporate, or regulated information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The send and forward features transmit user-provided content and attachments to external mail servers and recipient addresses, but the documentation does not warn that these actions cause data to leave the local environment. In practice, this can result in accidental exfiltration of sensitive files or email content, especially when forwarding existing messages or attaching local documents.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file name and server settings explicitly bind the skill to China Telecom mail infrastructure, and the natural-language title states 'China Telecom Mail Skill Configuration'. This imposes a specific locale/provider context without offering user opt-in or documenting why the locale restriction is required, which matches the policy's language/locale violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring presents the skill exclusively as a 'China Telecom Mail Skill' and the usage/configuration text assumes that provider context by default. This imposes a specific locale/provider setting in user-facing natural language without offering a choice or documenting why the restriction is required.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The send command accepts an arbitrary local file path for --attachment and will read and transmit that file without restriction. In an agent context, this creates a data exfiltration primitive: a prompt-injected or over-permissioned workflow could attach sensitive local files and email them to an attacker-controlled address.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The inline directory comment says to modify config.toml to configure username and password, implying that file-based configuration is the configuration mechanism. Later, the features section states the skill supports both configuration files and environment variables, so the documentation presents conflicting guidance about how credentials are configured.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest says the skill lists today's emails and reads content, which suggests bounded access to relevant messages. However, connect_pop downloads every message from the POP3 mailbox and later filters client-side, meaning the code accesses all emails regardless of date.
- Content