send-email

SAFE max severity MEDIUMSkillSpector Caution 15 registry clawhub.ai last scanned 2026-02-07 1 scan

Verdict safe, but 2 findings (2 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-07.

The send-email skill is a legitimate email-sending utility with MODERATE security concerns. The skill correctly avoids reading credential files directly (preventing credential exposure in tool output), but encourages plaintext credential storage in a predictable location. The primary risks are: (1) plaintext credential storage pattern in ~/.openclaw/openclaw.json, (2) potential command injection through unvalidated email parameters, and (3) missing input validation. The skill does not exhibit malicious behavior such as data exfiltration, prompt injection, or tool poisoning. The functionality matches the description, and the code is straightforward without obfuscation. Recommended actions: implement input validation, document secure credential management practices, and add explicit tool declarations.
Scanner's overall assessment (LLM analyzer)

Findings2

Critical0

High0

Medium2

Low0

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 15

Score15 / 100

Issues2

CategoriesMCP Least Privilege Excessive Agency

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Send emails via SMTP. Configure in ~/.openclaw/openclaw.json under skills.entries.send-email.env.

Package: 4 files, 9.2 KB
SKILL.md: 273 words, 6 sections
Code: Python (1), Shell (1)
Requires: anyBins: python3

SKILL.md covers: Send Email · Configuration · Agent instructions · Usage examples · SMTP reference · Troubleshooting

Findings

MEDIUM Hardcoded Credential Storage Location Exposure Data Exfiltrationllm

The skill instructions explicitly direct users to store SMTP credentials (EMAIL_SMTP_PASSWORD) in plaintext within ~/.openclaw/openclaw.json. While the skill correctly avoids reading this file directly (preventing credential exposure in tool output), the configuration pattern itself creates a security risk by encouraging plaintext credential storage in a predictable location. If the user's system is compromised, these credentials are easily accessible.

SKILL.md

Configure in **`~/.openclaw/openclaw.json`**:

```json
"skills": {
  "entries": {
    "send-email": {
      "enabled": true,
      "env": {
        "EMAIL_SMTP_SERVER": "smtp.163.com",
        "EMAIL_SMTP_PORT": "465",
        "EMAIL_SENDER": "your-email@163.com",
        "EMAIL_SMTP_PASSWORD": "YOUR_AUTH_CODE"
      }
    }
  }
}
```

Remediation: Recommend using system keychain/credential managers (e.g., macOS Keychain, Windows Credential Manager, Linux Secret Service) or encrypted credential storage. Document secure credential management practices. Consider integrating with OS-native credential storage APIs instead of plaintext JSON files.

MEDIUM Command Injection Risk via Unvalidated Email Parameters Command Injectionllm

The Python script (send_email.py) accepts email recipient, subject, and body as command-line arguments without apparent input validation or sanitization. While the script uses email.mime libraries (which provide some protection), the bash script (send_email.sh) directly interpolates these arguments into shell commands and file operations. An attacker could potentially inject shell metacharacters through these parameters if the agent passes unsanitized user input.

send_email.sh

Bash script: TO="$1"
SUBJECT="$2"
BODY="$3"

Python script accepts sys.argv without validation:
to_email = sys.argv[1]
subject = sys.argv[2]
content = sys.argv[3]

Remediation: Implement strict input validation for all email parameters: validate email addresses against RFC 5322 format, sanitize subject and body content to remove shell metacharacters, limit parameter lengths, and use parameterized commands instead of string interpolation. Consider using Python's shlex.quote() for shell argument escaping in the bash script.

What is in the package

File	Kind	Size
`README.md`	doc	1.4 KB
`SKILL.md`	doc	2.6 KB
`send_email.py`	script	3.6 KB
`send_email.sh`	script	1.6 KB

Environment variables referenced

ACCOUNT EMAIL_SMTP_PASSWORD EMAIL_SMTP_PORT EMAIL_SMTP_SERVER EMAIL_SENDER EMAIL_USE_TLS

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/send-email
Raw scan result: send-email-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-send-email.svg)
Request a re-scan