near-email
Verdict safe, but 2 findings (2 medium), mainly data exfiltration. Most recent scan 2026-02-01.
The near-email skill is a legitimate blockchain integration tool with MODERATE security concerns. The primary risks stem from its design as a public blockchain email system rather than malicious intent. The skill correctly warns users about public storage of email content, but lacks technical safeguards to prevent accidental sensitive data exposure. The hardcoded external dependencies (API endpoints and contract addresses) present a medium-severity supply chain risk without verification mechanisms. Missing optional metadata fields reduce transparency. No evidence of prompt injection, command injection, credential theft, or deliberate data exfiltration was found. The skill appears to function as described, but users should be aware of the public nature of blockchain storage and the trust placed in external services.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Send and read blockchain-native emails using NEAR Email service. Use when building notifications for NEAR smart contracts (NFT sales, DeFi liquidation alerts, DAO voting reminders) or when AI agents need email capabilities with a NEAR account identity.
- Package
- 3 files, 58 KB
- SKILL.md
- 810 words, 10 sections
- Code
- None. Instructions only.
SKILL.md covers: NEAR Email Integration · Installation · Quick Reference · Integration Methods · 1. Smart Contract (Rust) · 2. AI Agent Integration · 3. Python (Payment Key) · API Actions · Getting a Payment Key · Additional Resources
Findings
MEDIUM Hardcoded API Endpoint and Contract Address Without Verification Data Exfiltrationllm
The skill hardcodes external API endpoints (api.outlayer.fastnear.com) and contract addresses (outlayer.near) without any verification mechanism. While these appear to be legitimate NEAR blockchain services, there is no cryptographic verification of the endpoint authenticity or contract code hash validation. An attacker could potentially perform DNS hijacking or BGP hijacking to redirect API calls to malicious servers, enabling data interception or manipulation.
API Base: https://api.outlayer.fastnear.com
Contract: outlayer.near
No verification of contract code hash or API certificate pinning mentioned.MEDIUM Public Blockchain Storage of Email Content Data Exfiltrationllm
The skill's send_email_plaintext function stores email content publicly on the NEAR blockchain, which is immutable and permanently accessible. While the documentation warns users about this, the skill does not implement technical safeguards to prevent accidental exposure of sensitive information. Users might inadvertently send private data (credentials, personal information, business secrets) that becomes permanently public.
Warning in documentation: 'send_email_plaintext stores email content PUBLICLY on the NEAR blockchain. Use only for automated notifications'
No code-level validation to prevent sensitive data patterns (API keys, passwords, SSNs, etc.)What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 8.0 KB |
api-reference.md | doc | 11 KB |
examples.md | doc | 40 KB |
External hosts referenced
api.outlayer.fastnear.com rpc.mainnet.near.org mail.near.email outlayer.fastnear.com your-dao.near.page your-defi-app.near.page
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
OUTLAYER_API PROJECT_ID OUTLAYER_PAYMENT_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/near-email-skill
- Raw scan result: near-email-skill-scan.json
- Badge for your README:
- Request a re-scan