ClawHub
Back to skill

Security audit

osascript-email

Security checks for vulnerabilities and agentic risk

Overview

This skill openly automates Mail.app email sending, but it can send silently and its helper builds executable AppleScript from insufficiently validated inputs.

Install only if you specifically need macOS Mail.app automation. Require explicit approval before each send, especially for attachments, and do not pass untrusted or externally supplied recipient, sender, subject, body, or file path values into this helper until the AppleScript escaping and validation are fixed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The example demonstrates sending an email with a local file attachment to an arbitrary recipient, but it does not include any warning, confirmation step, or discussion of the privacy implications of transmitting local file contents off-device. In an agent skill context, this increases the risk of accidental data exfiltration because users or downstream agents may reuse the pattern without realizing that sensitive files can be sent externally.

Unvalidated Output Injection

High
Category
Output Handling
Content
end tell
return "sent"'''

    result = subprocess.run(
        ["osascript", "-e", script],
        capture_output=True,
        text=True
Confidence
98% confidence
Finding
User-controlled values such as to, cc, sender, subject, and body are interpolated directly into an AppleScript program executed by osascript. Escaping is incomplete and inconsistent: some fields are not escaped at all, backslashes are not handled everywhere, and AppleScript code can potentially be injected by crafted input, allowing unauthorized actions in Mail.app or other AppleScript-accessible applications under the current user context.

Static analysis

No suspicious patterns detected.