ClawHub
Back to skill

Security audit

Near Email Skill

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real NEAR Email integration, but it should be reviewed because it documents mailbox deletion without clear confirmation guidance and uses mutable global install/dependency patterns.

Install only if you are comfortable using OutLayer/NEAR for email operations and exposing payment keys or NEAR signing authority to the code you build from these examples. Require explicit human confirmation before any delete_email action, avoid plaintext emails for private content because the docs say they are public on-chain, and prefer pinned/local installs and pinned dependencies instead of the global unpinned commands shown.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:10
Finding

Unpinned Global Installation of a Remote Skill Package

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
examples.md:992
Finding

Unpinned Python Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md
PAYMENT_KEY = "your-account.near:nonce:secret"

def send_email(to: str, subject: str, body: str) -> dict:
    return requests.post(
        f"{OUTLAYER_API}/call/outlayer.near/zavodil.near/near-email",
        headers={"Content-Type": "application/json", "X-Payment-Key": PAYMENT_KEY},
        json={"input": {"action": "send_email_plaintext", "to": to, "subject": subject, "body": body}},

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented API includes a delete_email action but does not prominently warn that invoking it can permanently remove user data. In an agent-facing skill, omission of destructive-action warnings increases the chance that an LLM or integrator will call deletion functions without explicit user confirmation, causing unintended data loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-reference.md (reported line 21)May include surrounding context.

Option A: HTTPS API (Payment Key)

text
POST https://api.outlayer.fastnear.com/call/{contract}/{project}

| Contract | Project ID |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The API reference documents a destructive delete_email action with no warning about irreversible effects, no recommendation for user confirmation, and no guidance on access control or recovery. In an agent skill context, this increases the chance that an automated workflow deletes messages unintentionally or after prompt manipulation, causing data loss for the user.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes the skill as allowing users to 'Send and read blockchain-native emails,' which implies compose and retrieval capabilities. The example agent also exposes a deleteEmail/delete_email action, adding mailbox mutation behavior not reflected in the stated skill description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 654)May include surrounding context.

md
# Send email (plaintext - simplest option)
def send_email(to: str, subject: str, body: str) -> dict:
    response = requests.post(
        f"{OUTLAYER_API}/call/outlayer.near/{PROJECT_ID}",
        headers={"Content-Type": "application/json", "X-Payment-Key": PAYMENT_KEY},
        json={"input": {"action": "send_email_plaintext", "to": to, "subject": subject, "body": body}},

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 667)May include surrounding context.

md
# Send email (plaintext - simplest option)
def send_email(to: str, subject: str, body: str) -> dict:
    response = requests.post(
        f"{OUTLAYER_API}/call/outlayer.near/{PROJECT_ID}",
        headers={"Content-Type": "application/json", "X-Payment-Key": PAYMENT_KEY},
        json={"input": {"action": "send_email_plaintext", "to": to, "subject": subject, "body": body}},

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 859)May include surrounding context.

md
def _call_api(self, input_data: dict) -> dict:
        """Make API call to OutLayer"""
        response = requests.post(
            f"{OUTLAYER_API}/call/outlayer.near/{PROJECT_ID}",
            headers={
                "Content-Type": "application/json",

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest frames this skill around sending and reading NEAR Email messages. This documented Python agent also supports deleting emails via delete_email, which is a broader mailbox-management capability than the manifest claims.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.