T09 · Insecure Skill Coding Practices
Error
- Location
send_mail.py:7- Finding
Hard-Coded SMTP Credentials Expose the Email Account
- Content
View full analysis
- Remediation
View remediation
Security audit
my_send_email
Security checks for vulnerabilities and agentic risk
Overview
This email skill does what it says, but it embeds a live-looking SMTP password and sends email externally without enough user control or scoped runtime configuration.
Review before installing. This skill can send email outside your environment using an embedded SMTP account password, and it does not ask for confirmation before sending. The publisher should rotate the exposed password, move credentials to protected runtime configuration, use a package-relative entry point, and add explicit confirmation and recipient checks before external sends.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T07 · Tool Hijacking and Spoofing
Error
- Location
_meta.json:8- Finding
Skill Metadata Invokes an External, Unbundled Script Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill lacks any warning or safeguard about sending messages to external recipients, even though email can transmit sensitive information outside the organization. In this context, the absence of disclosure, validation, or confirmation materially increases the risk of accidental exfiltration and user-unaware outbound communication.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad enough to match ordinary user requests to notify or contact someone, which can cause this email-sending skill to activate unexpectedly. Because the skill performs an external side effect (sending email), unintended invocation can lead to data disclosure, spam, or actions taken without sufficiently explicit user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description uses broad trigger phrases such as 'user asks to send an email' and 'notify via email,' which can overlap with many normal conversational requests. In an agentic environment, this increases the chance the skill is invoked too readily, enabling unintended outbound communication or data exfiltration through email when the user did not explicitly consent to sending a message.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill sends arbitrary user-provided content to an external SMTP server immediately, with no confirmation, consent flow, or warning that data will leave the local environment. In an agent setting, this creates a real exfiltration path for sensitive prompts, generated content, or user data if the tool is invoked unexpectedly or with attacker-influenced inputs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language comments, usage text, and return messages are presented only in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-only context. This creates a locale policy issue because the skill effectively enforces one language without opt-in or justification.
- Content