imap-smtp-email

ISSUES FOUND max severity HIGHSkillSpector Do not install 91 registry clawhub.ai last scanned 1 scan

11 findings (1 high, 6 medium, 4 low), mainly data exfiltration, tool chaining abuse, social engineering. Most recent scan 2026-02-06.

This email management skill presents MODERATE to HIGH security risks primarily related to credential handling and data access. The skill's core functionality (IMAP/SMTP email access) is legitimate and matches its description, but it handles highly sensitive data (email credentials and content) with insufficient safeguards. Key concerns include: (1) plaintext credential storage in .env files, (2) broad unrestricted access to email content and attachments, (3) email sending capability without explicit confirmation requirements, (4) potential command injection vectors in script execution, and (5) ability to disable TLS certificate validation. The skill would benefit from additional security controls including mandatory user confirmation for sensitive operations, credential encryption, input validation, and more comprehensive security documentation. The missing 'allowed-tools' declaration and incomplete documentation also reduce transparency. Users should exercise caution and implement additional safeguards when using this skill with sensitive email accounts.

Scanner's overall assessment (LLM analyzer)
Findings11
Critical0
High1
Medium6
Low4
Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 91
Score91 / 100
Issues22
Categoriesanalysis-evasion Privilege Escalation Supply Chain
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Works with any IMAP/SMTP server including Gmail, Outlook, 163.com, vip.163.com, 126.com, vip.126.com, 188.com, and vip.188.com.

Package
6 files, 35 KB
SKILL.md
761 words, 12+ sections
Code
JavaScript (2), Shell (1)

SKILL.md covers: IMAP/SMTP Email Tool · Configuration · IMAP Configuration (receiving email) · SMTP Configuration (sending email) · Common Email Servers · IMAP Commands (Receiving Email) · check · fetch · download · search · mark-read / mark-unread · list-mailboxes

Findings

HIGH Hardcoded Email Credentials in Environment Configuration Data Exfiltrationllm

The skill requires users to store email credentials (IMAP_USER, IMAP_PASS, SMTP_USER, SMTP_PASS) in a .env file or environment variables. While this is a common pattern, it creates significant credential exposure risk if the .env file is accidentally committed to version control, shared, or accessed by other processes. The setup.sh script actively prompts users to enter credentials and writes them to disk in plaintext. Email credentials provide access to potentially sensitive communications and could be used for account takeover.

SKILL.md

IMAP_PASS=your_password
SMTP_PASS=your_password
The setup.sh script prompts for and stores credentials in plaintext .env file
Remediation: 1. Add .env to .gitignore and document this requirement prominently. 2. Recommend using app-specific passwords rather than account passwords (especially for Gmail). 3. Consider implementing credential encryption at rest. 4. Add warnings about credential security in documentation. 5. Implement secure credential storage using system keychains where possible.
MEDIUM TOOL CHAINING ABUSE detected by YARA Tool Chaining Abusestatic

Detects suspicious tool chaining patterns that could lead to data exfiltration: Read, search, and manage email via IMAP protocol. Send email

SKILL.md:3

Read, search, and manage email via IMAP protocol. Send email via SMTP. Supports Gmail, Outlook, 163.com, vip.163.com, 126.com, vip.126.com, 188.com, vip.188.com, and any standard IMAP/SMTP server.
Remediation: Review and remove tool chaining abuse pattern
MEDIUM TOOL CHAINING ABUSE detected by YARA Tool Chaining Abusestatic

Detects suspicious tool chaining patterns that could lead to data exfiltration: Fetch full email

SKILL.md:63

Fetch full email content by UID.
Remediation: Review and remove tool chaining abuse pattern
MEDIUM TOOL CHAINING ABUSE detected by YARA Tool Chaining Abusestatic

Detects suspicious tool chaining patterns that could lead to data exfiltration: read -p "Email address: " EMAIL

setup.sh:124

read -p "Email address: " EMAIL
Remediation: Review and remove tool chaining abuse pattern
MEDIUM Unrestricted Email Access and Data Exposure Data Exfiltrationllm

The skill provides broad access to email content including the ability to read all emails, download attachments, and search across mailboxes without apparent restrictions. The 'check' command can retrieve recent emails, 'fetch' can access full email content by UID, and 'download' can extract all attachments. This creates risk of excessive data collection if the agent autonomously accesses more emails than necessary for the user's stated task. Email content often contains sensitive personal information, financial data, and confidential communications.

SKILL.md

node scripts/imap.js check [--limit 10]
node scripts/imap.js fetch <uid>
node scripts/imap.js download <uid>
Commands allow unrestricted access to email content and attachments
Remediation: 1. Implement explicit user confirmation before accessing email content. 2. Add logging of all email access operations. 3. Limit the scope of email searches to user-specified criteria only. 4. Warn users before downloading attachments. 5. Consider implementing access controls or rate limiting.
MEDIUM Email Sending Capability Without Explicit Safeguards Data Exfiltrationllm

The skill includes SMTP functionality to send emails with attachments. While this is the stated purpose, there are no apparent safeguards mentioned to prevent misuse such as: sending emails without user confirmation, sending to unintended recipients, or being used for spam/phishing if the agent is compromised or manipulated. The SMTP configuration allows specifying a default sender address (SMTP_FROM) which could be used to impersonate the user.

SKILL.md

SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=your@gmail.com
SMTP_FROM=your@gmail.com
SMTP commands allow sending email with attachments
Remediation: 1. Require explicit user confirmation before sending any email. 2. Display full email details (to, from, subject, body, attachments) for user review before sending. 3. Implement rate limiting on email sending. 4. Log all sent emails. 5. Add warnings about email sending in the documentation.
MEDIUM Command Injection Risk in Node.js Script Execution Command Injectionllm

The skill executes Node.js scripts (imap.js, smtp.js) with command-line arguments that may include user-provided data such as email UIDs, mailbox names, search criteria, file paths, and email addresses. If these arguments are not properly sanitized in the Node.js scripts, they could be vulnerable to command injection attacks. The documentation shows examples like 'node scripts/imap.js search [options]' where options could include user-controlled strings.

SKILL.md

node scripts/imap.js fetch <uid>
node scripts/imap.js download <uid> [--dir <path>] [--file <filename>]
node scripts/smtp.js send --to <email> --subject <subject>
User-controlled parameters passed to shell commands
Remediation: 1. Review imap.js and smtp.js for proper input validation and sanitization. 2. Use parameterized command execution rather than string concatenation. 3. Validate all user inputs against expected formats (email addresses, UIDs, paths). 4. Implement allowlists for mailbox names and file paths. 5. Escape or reject special shell characters in all user inputs.
LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)
LOW TLS Certificate Validation Can Be Disabled Data Exfiltrationllm

The configuration allows setting IMAP_REJECT_UNAUTHORIZED=false and SMTP_REJECT_UNAUTHORIZED=false to bypass TLS certificate validation for self-signed certificates. While this may be necessary for some corporate environments, it exposes users to man-in-the-middle attacks where an attacker could intercept email credentials and content. The documentation mentions this option without adequate security warnings.

SKILL.md

IMAP_REJECT_UNAUTHORIZED=true     # Set to false for self-signed certs
SMTP_REJECT_UNAUTHORIZED=true     # Set to false for self-signed certs
Remediation: 1. Add prominent security warnings about disabling certificate validation. 2. Recommend this only for trusted internal networks. 3. Suggest obtaining proper certificates instead. 4. Default to true and require explicit opt-out. 5. Log warnings when certificate validation is disabled.
LOW Missing Security Metadata and Tool Restrictions Social Engineeringllm

The skill manifest is missing important security metadata: no 'allowed-tools' specification, no 'license' field, and no 'compatibility' information. The absence of 'allowed-tools' means there are no declared restrictions on which agent tools can be used, making it harder for users to assess the skill's capabilities and potential risks. While this is optional per the spec, it represents a missed opportunity for transparency.

allowed-tools: Not specified
license: Not specified
compatibility: Not specified
Remediation: 1. Add 'allowed-tools' field specifying [Bash, Read, Write] to document actual tool usage. 2. Add license information (e.g., MIT, Apache-2.0). 3. Add compatibility field noting requirements (Node.js, network access). 4. Consider adding version field for tracking. 5. Add author/maintainer information for accountability.
LOW Incomplete Documentation - Referenced Files Not Found Social Engineeringllm

The instruction body references three files (last.py, file.py, an.py) that were not found in the skill package. This appears to be corrupted or incomplete documentation, potentially from a truncated markdown section. While not a direct security threat, incomplete documentation could lead to user confusion or unexpected behavior if users attempt to use features that don't exist or are improperly documented.

Files referenced in instructions: last.py, file.py, an.py
All three files marked as 'not found'
Remediation: 1. Remove references to non-existent files from documentation. 2. Complete the truncated documentation sections. 3. Verify all referenced files are included in the package. 4. Add validation to ensure documentation matches actual package contents.

What is in the package

FileKindSize
README.mddoc4.2 KB
SKILL.mddoc5.9 KB
package.jsonconfig764 B
setup.shscript4.0 KB
scripts/imap.jsscript14 KB
scripts/smtp.jsscript5.7 KB

Environment variables referenced

EMAIL IMAP_HOST IMAP_PORT REJECT_UNAUTHORIZED SMTP_HOST SMTP_PORT IMAP_PASS IMAP_REJECT_UNAUTHORIZED PASSWORD SMTP_PASS SMTP_REJECT_UNAUTHORIZED PROVIDER_CHOICE

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills