ClawHub
Back to skill

Security audit

HERA Mail

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local HERA agent mail tool, but it gives agents broad automatic ability to read, write, persist, and copy local files without enough scoping or recipient controls.

Install only in a controlled HERA workspace. Treat messages and attachments as untrusted, verify sender and recipient names manually, avoid sending secrets or unrelated local files, and consider restricting attachments to an approved staging directory before relying on this skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill is configured as the primary communication method for essentially any HERA agent email activity and even sets an always-on metadata flag, which makes invocation scope extremely broad. Overly broad activation increases the chance an agent will use this skill in inappropriate contexts, causing unintended message sending, reading, or file transfer actions without sufficient user intent verification.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly supports sending arbitrary files of any type between agents and documents attachment paths and inbox locations, but provides no safeguards around sensitive data handling, recipient validation, file-type restrictions, or disclosure prevention. In a multi-agent internal messaging system, this raises a real risk of data leakage, over-sharing of workspace files, and propagation of unsafe or unnecessary attachments through normal workflow use.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script copies any user-supplied attachment path into another agent's inbox without restricting the source path or warning about the file access. In a multi-agent workspace, this can be abused to exfiltrate arbitrary readable local files into a recipient-accessible location, effectively turning the mail feature into a file-copy primitive across trust boundaries.

Static analysis

No suspicious patterns detected.