ClawHub
Back to skill

Security audit

Email Send

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward email-sending helper, but it can send mail and attachments through your SMTP account, so it needs careful use.

Install only if you want an agent to send email through your SMTP account. Use a dedicated app password or scoped SMTP credential where possible, keep SMTP_PASS out of prompts, logs, shell history, and committed files, and verify every recipient, message body, and attachment before sending.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill instructs users to send email via SMTP using environment-stored credentials but provides no warning about credential sensitivity, message transmission, recipient validation, or the risk of exposing secrets through shell history, logs, or misconfiguration. In a lightweight command-line email skill, this omission can lead to accidental disclosure of credentials or unintended transmission of sensitive content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.