mailgun

SAFE max severity MEDIUMSkillSpector Caution 15 registry clawhub.ai last scanned 2026-02-06 1 scan

Verdict safe, but 2 findings (2 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-06.

The Mailgun email sender skill is a straightforward implementation for sending emails via the Mailgun API. The skill has a clear purpose and reasonable functionality, but exhibits several security concerns primarily around credential management and input validation. The most significant issues are: (1) guidance to store API credentials in shell configuration files without adequate security warnings, and (2) lack of input validation on user-provided email parameters that could lead to injection issues. The skill does not contain malicious code, data exfiltration attempts, or prompt injection attacks. The missing optional metadata fields (license, compatibility, allowed-tools) reduce transparency but are not security threats. Overall, this skill is functional but needs security hardening around credential management and input validation before production use.
Scanner's overall assessment (LLM analyzer)

Findings2

Critical0

High0

Medium2

Low0

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 15

Score15 / 100

Issues3

CategoriesData Exfiltration MCP Least Privilege

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Send emails via Mailgun API. Use when the user needs to send emails programmatically, such as newsletters, notifications, alerts, or automated reports. Requires MAILGUN_API_KEY and MAILGUN_DOMAIN environment variables to be configured.

Package: 3 files, 4.0 KB
SKILL.md: 204 words, 10 sections
Code: Shell (1)

SKILL.md covers: Mailgun Email Sender · Prerequisites · Usage · Send a simple email · Send to a specific recipient · Send with custom sender · Features · Common Use Cases · Troubleshooting · References

Findings

MEDIUM Hardcoded API Credentials in Environment Variables Data Exfiltrationllm

The skill requires sensitive API credentials (MAILGUN_API_KEY) to be stored in shell configuration files (~/.zshrc or ~/.bash_profile). While environment variables are a common practice, the instructions explicitly guide users to hardcode credentials in persistent shell configuration files, which increases exposure risk if these files are accidentally committed to version control, backed up insecurely, or accessed by other processes.

SKILL.md

```bash
export MAILGUN_API_KEY="key-xxxxx"      # Your Mailgun private API key
export MAILGUN_DOMAIN="mg.yourdomain.com"  # Your Mailgun domain
export MAILGUN_FROM="Sender <noreply@mg.yourdomain.com>"  # Default sender
export MAILGUN_DEFAULT_TO="you@email.com"  # Default recipient (optional)
```

Remediation: Recommend using a more secure credential management approach: (1) Use a dedicated secrets manager (e.g., 1Password CLI, AWS Secrets Manager, HashiCorp Vault), (2) Store credentials in a separate .env file with restricted permissions (chmod 600) that is explicitly excluded from version control, (3) Add warnings about never committing credentials to git repositories, (4) Consider using Mailgun's API key scoping to limit permissions.

MEDIUM Potential Command Injection via Unvalidated Email Parameters Command Injectionllm

The bash script accepts user-provided subject and body parameters without proper validation or sanitization before passing them to curl via -F flags. While curl's -F flag provides some protection, special characters in subject/body could potentially cause unexpected behavior or be exploited in certain contexts. The script does not validate email format, length limits, or sanitize special characters.

scripts/send_email.sh

```bash
SUBJECT="$1"
BODY="$2"
TO="${3:-$MAILGUN_DEFAULT_TO}"
FROM="${4:-$MAILGUN_FROM}"
```
These variables are used directly in curl without validation:
```bash
-F subject="$SUBJECT" \
-F text="$BODY"
```

Remediation: Add input validation: (1) Validate email addresses using regex patterns, (2) Implement length limits for subject (e.g., 998 chars per RFC 2822) and body, (3) Sanitize or escape special characters that could cause issues, (4) Consider using curl's --data-urlencode for safer parameter encoding, (5) Add validation to reject potentially malicious patterns.

What is in the package

File	Kind	Size
`SKILL.md`	doc	1.9 KB
`references/api.md`	doc	1013 B
`scripts/send_email.sh`	script	1.1 KB

External hosts referenced

api.mailgun.net documentation.mailgun.com www.mailgun.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

MAILGUN_API_KEY MAILGUN_DOMAIN

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/mailgun
Raw scan result: mailgun-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-mailgun.svg)
Request a re-scan