Agent Mailbox Light

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:06 PM UTC
• Version: 1.1.1

Overview

This local mailbox skill is not deceptive, but it should be reviewed because mailbox messages can influence future agent behavior and the scripts can move, delete, or overwrite local files if misused.

Install only in workspaces where local agents and users are mutually trusted. Treat all mailbox bodies as quoted data, not instructions; verify any requested action before acting, avoid storing secrets, and be cautious about adding the AGENTS.md startup snippet until sender trust, path validation, and safer file-creation behavior are improved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:101

Finding

Unauthenticated Mailbox Content Can Influence Current and Future Agent Sessions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send-mailbox.sh:17

Finding

Predictable Mail Filenames Permit Symbolic-Link File Overwrite

Content

View full analysis

"$file" || true if [[ -f "$file" ]]; then printf '%s\n' "$file" delivered=$((delivered + 1)) fi done ``` ### Technical Analysis The output filename uses a timestamp with one-second resolution and attacker-controllable or readily known metadata. There is no random component, exclusive file creation, symbolic-link check, or canonical-path validation. The `> "$file"` redirection follows symbolic links and truncates an existing target before writing. A local attacker able to create entries in a destination inbox can predict the filename for an upcoming delivery and create a symbolic link with that name pointing to another file writable by the sender. When delivery occurs, the shell follows the link and replaces the target's contents with the generated mail. The subsequent `[[ -f "$file" ]]` test also follows symbolic links and therefore does not detect that delivery occurred outside the intended inbox ...[truncated 1204 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/archive-mailbox.sh:9

Finding

Mailbox Move Utilities Can Relocate Arbitrary Files and Overwrite Existing Messages

Content

View full analysis

&2; exit 1; } inbox_dir="$(dirname "$mail_file")" mail_root="$(dirname "$inbox_dir")" archive_dir="$mail_root/archive" mkdir -p "$archive_dir" mv "$mail_file" "$archive_dir/" printf '%s\n' "$archive_dir/$(basename "$mail_file")" ``` `scripts/keep-mailbox.sh` has the same issue: ```bash mail_file="$1" [[ -f "$mail_file" ]] || { echo "Mail file not found" >&2; exit 1; } source_dir="$(dirname "$mail_file")" mail_root="$(dirname "$source_dir")" keep_dir="$mail_root/keep" mkdir -p "$keep_dir" mv "$mail_file" "$keep_dir/" printf '%s\n' "$keep_dir/$(basename "$mail_file")" ``` ### Technical Analysis Both utilities trust a caller-provided path after checking only `[[ -f "$mail_file" ]]`. They do not verify that the file is located in an expected `.agent-mailbox/inbox/` or `.agent-mailbox/keep/` directory. They also do not canonicalize the source, establish an explicit workspace root, or ensure that the computed destination remains under a mailbox root. As a result, a caller can pass an unrelated filesystem file. The utility then computes a sibling `archive/` or `keep/` directory based on that arbitrary path and moves the file there. The unqualified `mv` operation may also overwrite an existing destination file with the same basename, depending on the platform and destination state. This issue is especially relevant when mailbox-provided text can influence which command or path an agent selects, but direct exploitation is also possible by any caller able to control the script argument. ### Attack Path 1. An att ...[truncated 1220 chars]

Remediation

View remediation

/.agent-mailbox/inbox/` or `/.agent-mailbox/keep/`. 4. Enforce that keep sources are located directly inside `/.agent-mailbox/inbox/`. 5. Reject symbolic links, non-regular files, nested paths, filenames containing path separators, and paths outside the approved mailbox directories. 6. Use no-clobber move semantics or fail if the destination basename already exists. 7. Verify file ownership and permissions before moving mailbox content. 8. Prefer accepting a validated mailbox message identifier or basename instead of an arbitrary filesystem path. 9. Apply the same containment and overwrite protections to both `archive-mailbox.sh` and `keep-mailbox.sh`. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script performs a destructive operation by deleting matching markdown files with find ... -delete, but there is no confirmation prompt, log/print statement, or comment/docstring warning the user that archived mailbox contents will be removed. For a cleanup script, deletion may be expected, but this file itself provides no user-visible disclosure of the action or retention behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This script moves the provided mail file into a keep directory, which changes the user's filesystem state and may affect downstream mail processing. While the usage line documents the argument format, there is no confirmation prompt, descriptive comment, or user-facing warning that the file will be relocated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.