ClawHub
Back to skill

Security audit

PO6 Mailbox

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PO6 mailbox and landing-page MCP integration with sensitive account capabilities that users should scope carefully.

Install only if you intend to connect OpenClaw to your PO6 account. Create a PO6 API key with the minimum scopes you need, prefer read-only scopes first, avoid broad send/delete/publish/domain permissions unless necessary, and remember that storing PO6_API_KEY in a shell profile makes it available across future sessions on that machine.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill is described as a mailbox and landing-page management integration, but the supplied content primarily configures an MCP server and references a local setup script that can modify OpenClaw configuration. This mismatch can mislead users and automated systems into authorizing a skill for benign-looking email tasks when it also performs local environment changes and depends on undeclared tooling.

Self-Modification

High
Category
Rogue Agent
Content
if jq -e '.mcpServers["po6-mailbox"]' "$CONFIG_FILE" &> /dev/null; then
        echo "PO6 MCP server is already configured."
        read -r -p "Overwrite existing config? [y/N] " confirm
        if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
            echo "No changes made."
            exit 0
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill omits any explicit tool restrictions while instructing the user to run a local setup script and modify local configuration, which implies shell-capable behavior outside the declared mailbox-management purpose. Without scoped permissions or allowed-tools metadata, an agent may invoke broader local capabilities than users expect, increasing the chance of unintended local system changes.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: po6-mailbox
description: "Manage PO6 email aliases, mailbox, and landing pages via the PO6 MCP server. Use when the user wants to read, send, search, compose, reply, or forward emails. Use when managing email aliases, forwarding rules, or custom domains. Use when creating, editing, publishing, or viewing analytics for landing pages. Triggers on check email, send email, search inbox, compose message, list aliases, create landing page, check leads, forward email, manage domain."
version: 1.0.0
homepage: https://po6.com
user-invocable: true
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The invocation text uses broad triggers such as checking email, sending email, and managing domains, which can overlap with many common user requests. Over-broad activation increases the risk that the skill is invoked in contexts where the user did not intend to expose mailbox contents or permit account-changing actions.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The manifest describes operational mailbox, alias, domain, and landing-page tasks, but this script additionally handles credential bootstrap by reading PO6_API_KEY from the environment and later embedding it into the OpenClaw config. While setup is related to installation, credential acquisition/storage is a separate capability not reflected in the stated skill purpose.

Scope Creep

Low
Category
Excessive Agency
Content
Manage your PO6 email aliases, mailbox, and landing pages through natural language.

PO6 gives you short, memorable email addresses like `you@po6.com` or email on your own domain. This skill connects to the PO6 MCP server so you can manage everything conversationally.

## Setup
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Intent-Code Divergence

Low
Confidence
71% confidence
Finding
The comment states the discovery-endpoint test uses 'no auth required,' which frames the check as sufficient validation of the configured server. In reality, the script only verifies unauthenticated reachability and does not validate the authenticated mailbox capability it just set up, making the comment/documentation misleading about what is actually tested.

Static analysis

No suspicious patterns detected.