{
  "skill_name": "clawmail",
  "skill_path": "/workspace/skills/clawhub-clawmail-skill",
  "skill_directory": "/workspace/skills/clawhub-clawmail-skill",
  "is_safe": false,
  "max_severity": "HIGH",
  "findings_count": 4,
  "findings": [
    {
      "id": "llm_finding_clawmail_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "API Key Exposure Risk via Instruction to Store Credentials in Plaintext",
      "description": "The skill instructs users to save API keys in plaintext files (~/.config/clawmail/credentials.json) and mentions storing them in 'memory, environment variables, or wherever you store secrets'. This creates a significant credential exposure risk, especially for autonomous agents that may not implement secure credential storage. The API key is described as 'your identity' and grants full access to the agent's email account.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Recommended:** Save your credentials to `~/.config/clawmail/credentials.json`:\n\n```json\n{\n  \"api_key\": \"cmail_xxx\",\n  \"agent_id\": \"my-agent\",\n  \"email\": \"my-agent@clawmail.to\"\n}\n```\n\nThis way you can always find your key later. You can also save it to your memory, environment variables (`CLAWMAIL_API_KEY`), or wherever you store secrets.",
      "remediation": "Recommend secure credential storage mechanisms (OS keychain, encrypted vaults, secure environment variable management). Warn against plaintext storage. Provide guidance on proper secret management for autonomous agents.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MEDIUM-HIGH security risks primarily related to credential management and supply chain integrity. The most significant concerns are: (1) instructions to store API keys in plaintext files, creating credential exposure risks; (2) reliance on remotely-fetched skill files without integrity verification, enabling potential supply chain attacks; (3) emphasis on autonomous operation 'without human intervention' which could lead to uncontrolled email operations. The skill does include positive security guidance (warning against sending API keys to other domains), but the credential storage recommendations and remote dependency model undermine overall security posture. No active malicious behavior detected, but the design patterns create exploitable vulnerabilities.",
        "primary_threats": [
          "Credential Exposure",
          "Supply Chain Risk",
          "Unbounded Autonomy",
          "Missing Security Metadata"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill explicitly recommends plaintext credential storage in a world-readable location. This is a clear security anti-pattern confirmed by both LLM analysis and the actual instruction content.",
        "meta_exploitability": "Easy - any process or user with file system access can read the credentials",
        "meta_impact": "High - full account compromise, unauthorized email access, potential spam/phishing campaigns using the compromised agent identity"
      }
    },
    {
      "id": "llm_finding_clawmail_1",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "External Dependency on Remote Skill Files Without Integrity Verification",
      "description": "The skill instructions reference external files (skill.md, skill.json) hosted at clawmail.to URLs and encourage users to 'just read them from the URLs above' or 'Re-fetch these files anytime to see new features'. This creates a supply chain risk where the skill behavior could be modified remotely without user awareness or integrity verification (no checksums, signatures, or version pinning).",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "| File | URL |\n|------|-----|\n| **SKILL.md** (this file) | `https://clawmail.to/skill.md` |\n| **package.json** (metadata) | `https://clawmail.to/skill.json` |\n\n**Install locally:**\n```bash\nmkdir -p ~/.moltbot/skills/clawmail\ncurl -s https://clawmail.to/skill.md > ~/.moltbot/skills/clawmail/SKILL.md\ncurl -s https://clawmail.to/skill.json > ~/.moltbot/skills/clawmail/package.json\n```\n\n**Or just read them from the URLs above!**\n\n**Check for updates:** Re-fetch these files anytime to see new features!",
      "remediation": "Implement integrity verification (SHA-256 checksums, digital signatures). Version pin the skill files. Warn users about the risks of auto-updating from remote sources. Consider bundling all necessary files within the skill package rather than fetching remotely.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MEDIUM-HIGH security risks primarily related to credential management and supply chain integrity. The most significant concerns are: (1) instructions to store API keys in plaintext files, creating credential exposure risks; (2) reliance on remotely-fetched skill files without integrity verification, enabling potential supply chain attacks; (3) emphasis on autonomous operation 'without human intervention' which could lead to uncontrolled email operations. The skill does include positive security guidance (warning against sending API keys to other domains), but the credential storage recommendations and remote dependency model undermine overall security posture. No active malicious behavior detected, but the design patterns create exploitable vulnerabilities.",
        "primary_threats": [
          "Credential Exposure",
          "Supply Chain Risk",
          "Unbounded Autonomy",
          "Missing Security Metadata"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill explicitly encourages fetching and executing remote content without any integrity checks. This is a well-known supply chain attack vector (AITech-1.2 Indirect Prompt Injection via transitive trust).",
        "meta_exploitability": "Medium - requires compromising clawmail.to server or MITM position, but no user verification step to detect tampering",
        "meta_impact": "Critical - arbitrary code execution through modified skill instructions, potential for widespread compromise if many agents auto-update"
      }
    },
    {
      "id": "llm_finding_clawmail_2",
      "rule_id": "LLM_RESOURCE_ABUSE",
      "category": "resource_abuse",
      "severity": "MEDIUM",
      "title": "Unbounded Autonomy for Email Operations Without User Confirmation",
      "description": "The skill description emphasizes 'no human intervention required' for creating inboxes and sending/receiving emails. For an autonomous AI agent, this could lead to uncontrolled email operations including spam generation, unauthorized communications, or resource exhaustion through excessive API calls, all without user oversight or confirmation.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "# ClawMail\n\nEmail infrastructure for autonomous AI agents. Create inboxes, send/receive emails, no human intervention required.",
      "remediation": "Implement rate limiting guidance, require user confirmation for sensitive operations (sending emails, creating new inboxes), add usage quotas, and provide clear boundaries for autonomous email operations.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MEDIUM-HIGH security risks primarily related to credential management and supply chain integrity. The most significant concerns are: (1) instructions to store API keys in plaintext files, creating credential exposure risks; (2) reliance on remotely-fetched skill files without integrity verification, enabling potential supply chain attacks; (3) emphasis on autonomous operation 'without human intervention' which could lead to uncontrolled email operations. The skill does include positive security guidance (warning against sending API keys to other domains), but the credential storage recommendations and remote dependency model undermine overall security posture. No active malicious behavior detected, but the design patterns create exploitable vulnerabilities.",
        "primary_threats": [
          "Credential Exposure",
          "Supply Chain Risk",
          "Unbounded Autonomy",
          "Missing Security Metadata"
        ],
        "aitech": "AITech-13.3",
        "aitech_name": "Availability Disruption",
        "aisubtech": "AISubtech-13.3.2",
        "aisubtech_name": "Compute Exhaustion",
        "scanner_category": "RESOURCE ABUSE",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The lack of safeguards is a design choice for autonomous operation, but it does create abuse potential. The verification system (Twitter linking) provides some accountability, mitigating the risk somewhat.",
        "meta_exploitability": "Medium - requires agent to be compromised or poorly configured, but then exploitation is straightforward",
        "meta_impact": "Medium - potential spam generation, reputation damage, service abuse, but limited by 100 emails/day rate limit"
      }
    },
    {
      "id": "llm_finding_clawmail_3",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Missing Critical Metadata Fields in Manifest",
      "description": "The skill manifest is missing several important security-relevant fields: 'license' (unknown legal terms), 'compatibility' (unclear what environments are safe), and 'allowed-tools' (no declared tool restrictions). This lack of transparency makes it difficult to assess the skill's intended scope and security boundaries.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "- license: Not specified\n- compatibility: Not specified\n- allowed-tools: Not specified",
      "remediation": "Add complete manifest metadata including: license (to clarify terms of use), compatibility (to specify supported environments), and allowed-tools (to declare which agent tools the skill requires, enabling security validation).",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MEDIUM-HIGH security risks primarily related to credential management and supply chain integrity. The most significant concerns are: (1) instructions to store API keys in plaintext files, creating credential exposure risks; (2) reliance on remotely-fetched skill files without integrity verification, enabling potential supply chain attacks; (3) emphasis on autonomous operation 'without human intervention' which could lead to uncontrolled email operations. The skill does include positive security guidance (warning against sending API keys to other domains), but the credential storage recommendations and remote dependency model undermine overall security posture. No active malicious behavior detected, but the design patterns create exploitable vulnerabilities.",
        "primary_threats": [
          "Credential Exposure",
          "Supply Chain Risk",
          "Unbounded Autonomy",
          "Missing Security Metadata"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The metadata fields are objectively missing from the manifest, as confirmed by the skill scanner output.",
        "meta_exploitability": "N/A - informational issue, not directly exploitable",
        "meta_impact": "Low - reduces transparency but doesn't create direct security vulnerabilities"
      }
    }
  ],
  "scan_duration_seconds": 36.832138538360596,
  "duration_ms": 36832,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-05T22:26:53.452742"
}