ClawHub
Back to skill

Security audit

Agent Email

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent guide for using a disposable email CLI, with the main caution that it may install an unpinned global npm or Bun package if the CLI is missing.

Install only if you trust the @zaddy6/agentemail package source. Prefer pinning or reviewing the package before global installation, and avoid using the CLI in environments with unrelated sensitive secrets if mailbox content or account profiles are not meant to be exposed to the agent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Package Installed Globally

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–26
Vulnerability Type: Unpinned third-party dependency installed in the global environment
Risk Level: Medium

Vulnerable Code

bash
If missing, install:

```bash
npm install -g @zaddy6/agentemail
# or
bun install -g @zaddy6/agentemail
text

### Technical Analysis

The skill instructs the agent to install the latest available version of `@zaddy6/agentemail` from a third-party package registry. The command does not specify an exact version or integrity hash, and the project provides no lockfile, source-verification procedure, or package-content review requirement.

Because the package is installed globally, its executable becomes available throughout the user's environment. Package installation may also execute lifecycle scripts with the installing user's privileges. Consequently, the code ultimately installed can differ from the code that existed when this skill was audited. This creates a supply-chain risk if the publisher account, package, or registry distribution path is compromised.

The package itself was not included in the audited artifact, so this finding does not establish that the current package release is malicious. It identifies an unsafe dependency acquisition process.

### Attack Path

1. An attacker compromises the package publisher account or another part of the registry distribution chain.
2. The attacker publishes a malicious release under the existing `@zaddy6/agentemail` package name.
3. The agent finds that `agent-email` is unavailable and follows the documented installation workflow.
4. npm or Bun resolves the unpinned dependency to the attacker-controlled release.
5. Malicious lifecycle code may run during installation, or malicious behavior may run when the globally installed CLI is invoked.
6. The payload executes with the privileges of the user performing the installation or running the CLI.

### Impact Assessment

Successful exploitation could execute 
...[truncated 518 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed version rather than installing the latest release:

    bash
    npm install --global --ignore-scripts @zaddy6/agentemail@<reviewed-exact-version>

  2. Verify the package's official repository, registry ownership, provenance, signatures where supported, and published integrity metadata before installation.

  3. Prefer a project-local dependency governed by a committed lockfile instead of a global installation.

  4. Disable package lifecycle scripts during installation unless they are required and have been separately audited.

  5. Document the expected package checksum or another independently verified integrity value.

  6. Review the installed package contents and transitive dependencies before permitting execution in workflows that can access credentials or sensitive mailbox content.

  7. Run the CLI with least privilege and isolate it from unrelated secrets and files where practical.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.