ClawHub
Back to skill

Security audit

Only read email

Security checks across malware telemetry and agentic risk

Overview

This email-reading skill appears read-only and purpose-aligned, but it asks for mailbox credentials and supports storing them in broad or plaintext locations without enough scoping or consent guidance.

Install only if you are comfortable giving the agent read access to the mailbox. Prefer a revocable app-specific password or authorization code, avoid passing secrets on the command line, avoid global config unless necessary, remove stored credentials after use, and treat email content, especially verification codes, as highly sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill explicitly instructs users to provide email credentials and to store them in environment variables or configuration files, yet the skill metadata declares no permissions. This creates a mismatch between the skill's real access to sensitive secrets and its declared trust boundary, which can mislead operators and make secret handling invisible to policy or review systems.

Missing User Warnings

High
Confidence
98% confidence
Finding
The workflow tells the agent to ask for the user's email account and authorization code/password, but provides no prominent user-facing privacy warning, consent language, or safe handling constraints. This is dangerous because it normalizes direct collection of highly sensitive credentials, which may then be exposed via logs, chat history, memory, telemetry, or insecure storage paths described elsewhere in the skill.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The tool accepts email credentials via command-line arguments and environment variables without warning about their sensitivity. Command-line arguments can be exposed through shell history, process listings, job control logs, or orchestration metadata, which can leak mailbox passwords or app-specific authorization codes to other local users or monitoring systems.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.