smtp-send
2 findings (1 high, 1 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-07.
The smtp-send skill provides legitimate email functionality but has several security concerns primarily related to credential management and input validation. The most significant issue is the requirement to store SMTP credentials in plaintext in a config file without enforced security measures. While the skill's core functionality (sending emails via SMTP) is straightforward and not inherently malicious, the credential handling practices create unnecessary exposure risks. The skill would benefit from implementing secure credential storage, stronger input validation on file attachments, and resource limits. The missing metadata fields (allowed-tools, license, compatibility) reduce transparency but are not critical security issues. Overall, this skill is functional but requires security improvements before use in production environments with sensitive credentials.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Send emails via SMTP with support for plain text, HTML, and attachments. Use when the user asks to send an email, email someone, or compose and send a message. Supports single recipients and can include file attachments. Works with Gmail, Outlook, Yahoo, QQ Mail, 163 Mail, and any SMTP server.
- Package
- 3 files, 12 KB
- SKILL.md
- 402 words, 11 sections
- Code
- Python (1)
SKILL.md covers: SMTP Send · Quick Start · Setup · Parameters · Common Patterns · User provides recipient and content · User provides only content · File attachments · HTML formatting · Error Handling · Security
Findings
HIGH Hardcoded Credential Storage in User Home Directory Data Exfiltrationllm
The skill requires users to store SMTP credentials (username and password) in plaintext in ~/.smtp_config file. While the documentation mentions file permissions should be 600, the script does not enforce this, and credentials remain in plaintext on disk. This creates a significant data exposure risk if the user's system is compromised or if file permissions are misconfigured.
scripts/send_email.py
config_file = Path.home() / '.smtp_config'
if config_file.exists():
try:
with open(config_file) as f:
config = json.load(f)MEDIUM Insufficient Input Validation on File Attachments Command Injectionllm
The script accepts file paths for attachments via command-line arguments without sufficient validation. While it checks if files exist, it does not validate file types, sizes, or prevent path traversal. An attacker could potentially use this to attach sensitive system files or cause resource exhaustion with large files.
scripts/send_email.py
--attachments parameter accepts comma-separated file paths without validation of file type, size limits, or path traversal preventionWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.3 KB |
references/setup.md | doc | 3.4 KB |
scripts/send_email.py | script | 5.5 KB |
External hosts referenced
myaccount.google.com login.yahoo.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
SMTP_HOST SMTP_PASSWORD SMTP_PORT
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/smtp-send
- Raw scan result: smtp-send-scan.json
- Badge for your README:
- Request a re-scan