Zero‑Exposure SMTP Mail Sender (MGC Secure Edition)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:36 AM UTC
• Version: 2.1.1

Overview

This email skill is not proven malicious, but it needs review because it stores and runs a reusable local email script that can access saved credentials and send mail while the docs overstate its privacy boundaries.

Install only if you trust MGC Blackbox and are comfortable with a persistent local script that can read stored SMTP credentials and send email. Use a pinned, reviewed dependency version, store credentials through the WebUI, do not pass sensitive email bodies inline unless you accept agent/log exposure, and require explicit confirmation before every script save, overwrite, and email send.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Unpinned Installation of a Security-Sensitive Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:63-66
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install mgc-blackbox>=1.4.10

Technical Analysis

The installation instruction accepts version 1.4.10 and every future release of mgc-blackbox. It does not use an exact version, cryptographic hashes, a lockfile, or another integrity-verification mechanism.

Because Python package installation can execute package-controlled build and installation logic, a compromised publisher account, package repository, or future package release could introduce arbitrary code that users would install by following these instructions. This risk is particularly significant because the dependency is expected to manage scripts, authentication tokens, and SMTP credentials.

The audit found no evidence that the currently referenced package is malicious. The vulnerability is the unsafe trust and update model.

Attack Path

1. An attacker compromises the package publisher, distribution account, or upstream release process.
2. The attacker publishes a malicious version newer than 1.4.10.
3. The malicious version satisfies the unrestricted >=1.4.10 constraint.
4. A user follows the documented installation command.
5. pip downloads and installs the malicious release.
6. Package-controlled installation or runtime code executes with the privileges of the user running pip or MGC.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that user's permissions, the malicious dependency could access local files, the MGC token and credential store, stored SMTP credentials, email content, and other data available to the MGC process. It could also transmit data externally or alter scripts executed through MGC.

The scope is limited by the operating-system privileges of the ...[truncated 135 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the range constraint with an exact, reviewed version, such as mgc-blackbox==1.4.10.
• Publish a lockfile or requirements file containing cryptographic hashes and install with pip --require-hashes.
• Verify the official package name, publisher, repository, and distribution source in the documentation.
• Review each dependency upgrade before changing the pinned version.
• Prefer installation in a dedicated virtual environment under an unprivileged account.
• Document a secure update process that verifies package provenance and release integrity.

T08 · Insecure Dependencies

Warning

• Location: manifest.json:11

Finding

Manifest Declares an Unbounded Third-Party Dependency Version

Content

View full analysis

Vulnerability Details

File Location: manifest.json:11
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

json

"install": "pip install mgc-blackbox>=1.4.10",

Technical Analysis

The manifest directs consumers or automation to install any mgc-blackbox version greater than or equal to 1.4.10. No exact version or artifact hash is specified. If the manifest installation field is executed automatically, users may receive a future release that was not reviewed as part of this Skill audit.

Installation of a Python package may execute package-controlled code. The dependency also forms part of the Skill's security boundary because it has access to black-box scripts, local API authentication, and sensitive configuration.

No evidence establishes that the current package is malicious; the issue is exposure to future or compromised releases without integrity controls.

Attack Path

1. An attacker gains control of the package publication channel or compromises a future upstream release.
2. A malicious package version greater than 1.4.10 is published.
3. A Skill installer processes the manifest's install command.
4. Dependency resolution selects the malicious compatible version.
5. Malicious installation or runtime code executes under the installer's account.
6. The attacker accesses or modifies resources available to the MGC environment.

Impact Assessment

Exploitation could result in arbitrary code execution with the privileges of the account installing or running the package. Potentially exposed resources include the MGC authentication token, SMTP credentials, stored email bodies, stored scripts, and other user-readable files. An attacker could also subvert future black-box executions.

System-wide impact would depend on whether installation occurs as an ordinary user, administrator, or root.

Remediation

View remediation

Remediation Suggestions

• Change the manifest to reference an exact reviewed version.
• Use a hash-locked requirements file rather than embedding an unrestricted pip install command.
• Ensure automated installers reject packages whose hashes do not match reviewed artifacts.
• Run installation and MGC under a dedicated, least-privileged account.
• Require a security review before updating the dependency version or approved hashes.

T08 · Insecure Dependencies

Warning

• Location: readme.md:34

Finding

README Recommends Installing an Unpinned Dependency

Content

View full analysis

Vulnerability Details

File Location: readme.md:34-37
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

markdown

## Prerequisites

- Python 3.10+
- `pip install mgc-blackbox>=1.4.10`
- MGC service running: `mgc` (API at http://127.0.0.1:57219, WebUI at 57218)

Technical Analysis

The user-facing setup instructions permit all future versions of mgc-blackbox. This prevents reproducible installation and means the installed code may differ from the version considered when the Skill was authored or reviewed.

Neither package hashes nor provenance checks are supplied. Since package installation and subsequent MGC execution can run dependency-controlled code, compromise of the upstream distribution channel can become local code execution.

Attack Path

1. An attacker compromises the dependency's release or package-distribution channel.
2. The attacker publishes a malicious release satisfying >=1.4.10.
3. A user copies the README installation command.
4. pip resolves and installs the malicious release.
5. Attacker-controlled code runs during installation or when MGC starts.
6. The code accesses data and capabilities available to the affected user.

Impact Assessment

The attacker could obtain the privileges of the installing or runtime user. In this project's expected environment, that may include access to the local MGC token, credential database, SMTP credentials, private email content, and stored executable scripts. The attacker could undermine both confidentiality and execution integrity.

The audit did not identify a currently malicious dependency or a confirmed compromise; this assessment describes the exploitability of the unpinned installation process.

Remediation

View remediation

Remediation Suggestions

• Update the README to install a specific reviewed version.
• Provide a hash-pinned requirements or lock file and a corresponding pip --require-hashes command.
• Identify the authoritative package index and upstream project.
• Advise installation in an isolated virtual environment without administrator privileges.
• Establish a documented review and verification procedure for dependency upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents and embeds functionality that performs network access, local file reads/writes, and script execution, yet it declares no explicit tool scope or permission boundaries. In an agent environment, that omission can cause overbroad invocation and execution of capabilities the user did not clearly authorize, especially for email transmission and access to local MGC tokens.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill says AI never sees script content, but the full script is present in the skill file itself. This is a security-model inconsistency that can mislead users into believing implementation details and secret-handling logic are hidden from the agent when they are not.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document claims to be documentation-only and non-executable, but it includes a complete working Python script and exact execution flow. This mismatch can mislead reviewers and downstream agents about the real capability surface, reducing scrutiny around code that reads tokens, retrieves secrets, and sends external email.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill instructs users to store a persistent executable script in MGC that can later be run blackbox to access local secrets and send network email. Persistent storage of an executable payload increases the blast radius of prompt mistakes, unauthorized reuse, or later invocation in contexts where the user did not intend email transmission.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Step 2: Store Email Script (User via mgc_save)

Create an email script with argparse (literal defaults only) and store it in MGC:

python

import smtplib

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This duplicate finding points to the same token-bearing credential retrieval request to the local MGC sensitive API. The risk is not classic external exfiltration over the internet, but it is still a sensitive transmission path that enables secret access from within the script.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This duplicate finding points to the same token-bearing credential retrieval request to the local MGC sensitive API. The risk is not classic external exfiltration over the internet, but it is still a sensitive transmission path that enables secret access from within the script.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

This duplicate finding points to the same token-bearing stored-content retrieval call. In context, it expands the script's ability to pull protected local data and combine it with outbound email behavior, increasing the consequence of misuse.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": content_name, "action": "run"},

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

This duplicate finding points to the same token-bearing stored-content retrieval call. In context, it expands the script's ability to pull protected local data and combine it with outbound email behavior, increasing the consequence of misuse.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": content_name, "action": "run"},

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inline comment contains Chinese text in a way that imposes a specific language/locale within the skill content, with no indication that the user can choose language. This is a natural-language policy issue because the skill does not offer opt-in or explain a justified locale constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states it does not provide automated email sending, but its included script plus mgc_run instructions do exactly that. This contradiction obscures the true operational behavior of the skill and may bypass user or platform expectations around outbound communication automation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.py (reported line 28)May include surrounding context.

python

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.py (reported line 54)May include surrounding context.

python

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.py (reported line 28)May include surrounding context.

python

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.py (reported line 54)May include surrounding context.

python

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · example.py (reported line 28)May include surrounding context.

python

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · example.py (reported line 54)May include surrounding context.

python

with open(token_path) as f:
        token = f.read().strip()

    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={"info_type": "config", "info_owner": cred_name, "action": "run"},

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The function sends an outbound email using SMTP, including message content and recipient data, but the code provides no confirmation prompt or user-facing notice at the point of transmission. The docstring only says "Send email via SMTP," which documents function purpose for developers but does not meaningfully warn users that their content will be transmitted externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest describes a zero-exposure pattern where AI never sees credentials, script content, or the email body when stored in MGC. However, the script explicitly writes execution results to a file so the AI can read them, and the skill also supports direct --body input, meaning the operational model is not strictly 'AI never sees email body' except in the optional stored-content path.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README presents a safety boundary of 'only executes scripts with explicit user authorization' while also documenting flows to create or overwrite scripts and credentials in MGC. That mismatch can mislead operators into granting broader agent capabilities than intended, especially if overwrite operations are later automated without a distinct approval step.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document claims the AI never sees the email body, but the mgc_run example includes --body "Hello" directly in the arguments, which the AI necessarily handles. This is a privacy and data-handling contradiction that could expose sensitive message content to the model, logs, or tool traces.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Security section says the AI never sees script content, but earlier instructions tell users to paste example.py into mgc_save, with the AI able to assist. This creates a false assurance about script secrecy and may cause users to disclose executable code, embedded secrets, or unsafe logic to the model under the mistaken belief that it remains hidden.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The sandbox guidance recommends calling the FastAPI endpoint directly at /api/mgc/sensitive/run when MCP operations are limited, but it does not warn that this may bypass the documented approval or blackbox safeguards. That omission can encourage deployments that execute sensitive scripts through a lower-friction path with weaker user awareness, review, or auditing.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The trigger condition 'when user wants to send an email' is underspecified, so an agent may invoke the skill too broadly for loosely related requests. For a capability that can transmit data externally, ambiguous activation increases the risk of unintended email sending or execution of stored scripts without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.