Security audit

weavmail

Security checks for vulnerabilities and agentic risk

Overview

This email-management skill is mostly coherent, but it handles real email credentials and can send or modify mail without enough built-in guardrails.

Review this before installing if you will connect real mail accounts. Use app-specific passwords or OAuth where possible, avoid putting passwords directly in chat or shell commands, restrict commands to a named account instead of syncing all accounts by default, and require an explicit final confirmation before sending, archiving, trashing, or moving any email.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Third-Party Email Client Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 15-19 **Vulnerability Type**: Unpinned executable dependency **Risk Level**: Medium ```bash Install once before first use: ```bash uv tool install weavmail ``` ``` ### Technical Analysis The Skill directs the agent to install and execute the latest registry version of `weavmail` without pinning a reviewed version or verifying a package hash or signature. Consequently, the effective executable can change after this Skill has been audited. This dependency is security-sensitive because it processes IMAP and SMTP credentials, downloads private email, and performs mailbox operations. A compromised publisher account, malicious package release, or compromised transitive dependency could introduce arbitrary behavior into a future installation. No evidence demonstrates that the current package is malicious. The vulnerability is the mutable, unverified dependency installation process and the resulting supply-chain exposure. ### Attack Path 1. An attacker compromises the package publisher, distribution channel, or a transitive dependency used by a later `weavmail` release. 2. The attacker publishes a modified version under the package name expected by the Skill. 3. A user or agent follows the documented `uv tool install weavmail` instruction. 4. The package manager retrieves and installs the attacker-controlled release. 5. The installed executable runs with the user's local privileges. 6. During account configuration or synchronization, the executable can access credentials, downloaded email, and mailbox operations. ### Impact Assessment A compromised dependency could execute code with the privileges of the user running the agent. Within the declared workflow, it could access configured email credentials, read synchronized messages, transmit mailbox data, send email under the user's identity, or modify and delete messages. The impact is bounded by the oper ...[truncated 167 chars]
Remediation: ## Remediation Suggestions - Pin `weavmail` to a specific version that has been reviewed, for example through an exact package version constraint. - Use a lockfile or equivalent immutable dependency manifest, including transitive dependency versions. - Verify package hashes or cryptographic signatures before installation. - Document the expected official publisher, package index, and source repository so users can detect name confusion or source substitution. - Review new versions before updating the pin. - Where possible, install from a trusted internal mirror containing only approved artifacts. - Run the email client with the minimum filesystem and network permissions required for the configured mail service.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:21
Finding: Email Password Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 21-40 **Vulnerability Type**: Plaintext credential exposure through process arguments and shell history **Risk Level**: Medium ```bash Configure an account (named `default`): ```bash weavmail account config \ --imap-host imap.example.com \ --smtp-host smtp.example.com \ --username you@example.com \ --password your-app-password \ --addresses you@example.com ``` `--username` and `--password` set both IMAP and SMTP credentials at once. The account name defaults to `default` and can be omitted from all subsequent commands. Each option can be updated independently — only the options you pass are changed, everything else is preserved. For example, to update just the password: ```bash weavmail account config --password new-password ``` ``` ### Technical Analysis The documented configuration procedure places the email password directly in a command-line argument. Command-line secrets may be exposed through shell history, process inspection facilities, terminal recording, automation logs, debugging output, audit systems, and agent conversation transcripts. The same unsafe pattern is recommended both for initial configuration and password updates. Even if the CLI securely stores the credential after configuration, that does not prevent exposure while the command is entered or executed. The implementation of `weavmail` is not included in the audited project, so its credential storage protections could not be verified. ### Attack Path 1. A user supplies a real IMAP/SMTP password by following the documented command. 2. The plaintext credential becomes part of the command line. 3. The command is retained in shell history, captured in a transcript or log, or observed through local process inspection while it is running. 4. A local user, monitoring service, support operator, or other party with access to that record retrieves the password. 5. ...[truncated 692 chars]
Remediation: ## Remediation Suggestions - Replace the `--password` argument with hidden interactive input that disables terminal echo. - Alternatively, accept the secret through a protected file descriptor, operating-system keychain, or dedicated secret manager. - Avoid environment variables where stronger secret-passing mechanisms are available, because environments may also be observable or logged. - Explicitly instruct users not to enter credentials into chat messages, shell command arguments, or reusable scripts. - Prevent secret-bearing commands from being written to shell history and redact credentials from all application and agent logs. - Store credentials using an operating-system credential vault rather than a plaintext configuration file. - Apply restrictive permissions to any local configuration or token files. - Prefer narrowly scoped, revocable application passwords or OAuth tokens instead of the user's primary account password.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation description is broad enough to trigger on many ordinary email-related tasks, which can cause the agent to invoke a capability that reads, moves, trashes, archives, or sends mail without sufficiently narrow scoping. In a skill that interfaces with real external email accounts, overbroad activation increases the chance of unnecessary access to sensitive messages and unintended side effects.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill provides direct instructions for sending and replying to email but does not require an explicit confirmation step before performing an external outbound action. Because sending email can disclose sensitive information, contact third parties, or create irreversible business and legal consequences, omission of a mandatory confirmation gate is dangerous in an agent-operated workflow.

Static analysis

No suspicious patterns detected.