clawmail
4 findings (1 high, 3 medium), mainly data exfiltration, unauthorized tool use, resource abuse. Most recent scan 2026-02-05.
This skill presents MEDIUM-HIGH security risks primarily related to credential management and supply chain integrity. The most significant concerns are: (1) instructions to store API keys in plaintext files, creating credential exposure risks; (2) reliance on remotely-fetched skill files without integrity verification, enabling potential supply chain attacks; (3) emphasis on autonomous operation 'without human intervention' which could lead to uncontrolled email operations. The skill does include positive security guidance (warning against sending API keys to other domains), but the credential storage recommendations and remote dependency model undermine overall security posture. No active malicious behavior detected, but the design patterns create exploitable vulnerabilities.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Email infrastructure for autonomous AI agents. Create inboxes, send/receive emails, no human intervention required.
- Package
- 1 file, 13 KB
- SKILL.md
- 1557 words, 12+ sections
- Code
- None. Instructions only.
- Version
- 1.0.0
- Homepage
- https://clawmail.to
SKILL.md covers: ClawMail · Skill Files · Register First · Verify Your Agent (Required!) · Step 1: Start Verification · Step 2: Post the Tweet · Step 3: Complete Verification · Check Verification Status · Authentication · Agents · Get Agent Details · Rotate API Key
Findings
HIGH API Key Exposure Risk via Instruction to Store Credentials in Plaintext Data Exfiltrationllm
The skill instructs users to save API keys in plaintext files (~/.config/clawmail/credentials.json) and mentions storing them in 'memory, environment variables, or wherever you store secrets'. This creates a significant credential exposure risk, especially for autonomous agents that may not implement secure credential storage. The API key is described as 'your identity' and grants full access to the agent's email account.
SKILL.md
Recommended:** Save your credentials to `~/.config/clawmail/credentials.json`:
```json
{
"api_key": "cmail_xxx",
"agent_id": "my-agent",
"email": "my-agent@clawmail.to"
}
```
This way you can always find your key later. You can also save it to your memory, environment variables (`CLAWMAIL_API_KEY`), or wherever you store secrets.MEDIUM External Dependency on Remote Skill Files Without Integrity Verification Unauthorized Tool Usellm
The skill instructions reference external files (skill.md, skill.json) hosted at clawmail.to URLs and encourage users to 'just read them from the URLs above' or 'Re-fetch these files anytime to see new features'. This creates a supply chain risk where the skill behavior could be modified remotely without user awareness or integrity verification (no checksums, signatures, or version pinning).
SKILL.md
| File | URL |
|------|-----|
| **SKILL.md** (this file) | `https://clawmail.to/skill.md` |
| **package.json** (metadata) | `https://clawmail.to/skill.json` |
**Install locally:**
```bash
mkdir -p ~/.moltbot/skills/clawmail
curl -s https://clawmail.to/skill.md > ~/.moltbot/skills/clawmail/SKILL.md
curl -s https://clawmail.to/skill.json > ~/.moltbot/skills/clawmail/package.json
```
**Or just read them from the URLs above!**
**Check for updates:** Re-fetch these files anytime to see new features!MEDIUM Unbounded Autonomy for Email Operations Without User Confirmation Resource Abusellm
The skill description emphasizes 'no human intervention required' for creating inboxes and sending/receiving emails. For an autonomous AI agent, this could lead to uncontrolled email operations including spam generation, unauthorized communications, or resource exhaustion through excessive API calls, all without user oversight or confirmation.
SKILL.md
# ClawMail
Email infrastructure for autonomous AI agents. Create inboxes, send/receive emails, no human intervention required.MEDIUM Missing Critical Metadata Fields in Manifest Social Engineeringllm
The skill manifest is missing several important security-relevant fields: 'license' (unknown legal terms), 'compatibility' (unclear what environments are safe), and 'allowed-tools' (no declared tool restrictions). This lack of transparency makes it difficult to assess the skill's intended scope and security boundaries.
SKILL.md
- license: Not specified
- compatibility: Not specified
- allowed-tools: Not specifiedWhat is in the package
| File | Kind | Size |
|---|---|---|
skill.md | doc | 13 KB |
External hosts referenced
api.clawmail.to clawmail.to x.com github.com twitter.com verify.clawmail.to
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
CLAWMAIL_API_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/clawmail-skill
- Raw scan result: clawmail-scan.json
- Badge for your README:
- Request a re-scan