ClawHub
Back to skill

Security audit

Automatically logs into email accounts (Gmail, Outlook, QQ Mail, etc.) and generates daily email summaries. Use when the user wants to get a summary of their emails, check important messages, or create daily email digests.

Security checks for vulnerabilities and agentic risk

Overview

The skill’s email-summary purpose is coherent, but it handles private mailbox access in ways that need review before installation.

Install only if you are comfortable granting browser automation access to your logged-in email. Avoid typing real passwords into shell commands, avoid saving inbox screenshots unless needed, store outputs in a private directory, and do not enable cron or launchd scheduling unless you understand how to disable it and protect the script and logs.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:215
Finding
Persistent Daily Execution Through Cron and a macOS LaunchAgent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 215-254 **Vulnerability Type**: Persistent scheduled task and user-level startup service **Risk Level**: High ### Evidence ```bash crontab -e 0 9 * * * /path/to/email_daily_summary.sh >> /path/to/logs/email_summary.log 2>&1 ``` ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.email.dailysummary</string> <key>ProgramArguments</key> <array> <string>/bin/bash</string> <string>/path/to/email_daily_summary.sh</string> </array> <key>StartCalendarInterval</key> <dict> <key>Hour</key> <integer>9</integer> <key>Minute</key> <integer>0</integer> </dict> <key>StandardOutPath</key> <string>/tmp/email_summary.log</string> <key>StandardErrorPath</key> <string>/tmp/email_summary_error.log</string> </dict> </plist> ``` ```bash launchctl load ~/Library/LaunchAgents/com.email.dailysummary.plist ``` ### Technical Analysis The Skill instructs users to register a cron entry or load a macOS LaunchAgent that invokes a shell script every day. Both mechanisms survive the original Skill invocation and continue executing until explicitly removed. Scheduled execution is consistent with the optional daily-automation feature, but it is not required for the core function of producing an email summary on demand. It therefore exceeds the minimum privileges and lifecycle needed for the basic task. The documentation does not provide an uninstall procedure, verify the integrity or ownership of the referenced script, enforce restrictive file permissions, or require an explicit security confirmation before enabling persistence. Because the scheduler invokes a mutable filesystem path through `/bin/bash`, any party able to replace or modify that script can convert the legi ...[truncated 1192 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Remove scheduler registration from the default workflow and keep on-demand summary generation as the default. - Present scheduling as a separate, explicit opt-in operation with a clear explanation that it creates cross-session execution. - Invoke a fixed absolute script path located in a user-owned directory that is not writable by other users. - Apply restrictive ownership and permissions to the script, configuration, output directory, and logs. - Avoid executing a mutable script through a general-purpose shell where a narrowly scoped executable or command can be used. - Validate the script's ownership and integrity before every scheduled invocation. - Use a restricted environment with a minimal `PATH` and only the environment variables required for the task. - Avoid writing potentially sensitive mailbox output to shared temporary directories. - Document complete removal procedures, including deletion of the cron entry and execution of `launchctl unload` followed by removal of the property-list file. - Require renewed user consent before enabling access to an authenticated browser profile from an unattended scheduled process. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding
Unpinned Third-Party Browser Automation Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21-22 **Vulnerability Type**: Unpinned third-party dependency and mutable installer behavior **Risk Level**: Medium ### Evidence ```bash uv pip install browser-use[cli] browser-use install ``` ### Technical Analysis The installation instructions obtain the latest resolvable version of `browser-use` and its optional CLI dependencies without a version constraint, lockfile, or cryptographic hashes. The subsequent `browser-use install` command may also install additional browser components whose exact versions and artifacts are not specified in the reviewed Skill. Consequently, the effective code installed when a user follows these instructions can change after the Skill has been audited. A compromised upstream release, dependency, package index account, or installer artifact could introduce arbitrary local behavior into a workflow that is expected to access authenticated email sessions. ### Attack Path 1. The user follows the documented installation commands. 2. The dependency resolver obtains the currently published package and transitive dependencies rather than a reviewed fixed set. 3. An upstream package, transitive dependency, or installer artifact has been compromised or has introduced unsafe behavior. 4. Package installation or subsequent CLI execution runs the changed code locally. 5. The compromised component gains access to data available to the browser automation process, potentially including authenticated browser state and mailbox contents. ### Impact Assessment A compromised dependency could execute with the installing user's privileges. Because this package is subsequently used to control an authenticated browser and inspect email pages, the accessible scope may include browser-session information, displayed email metadata and content, screenshots, local summary files, and other files readable by the user. The instructions do not request administrator privileges, so dire ...[truncated 59 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pin `browser-use` and all transitive dependencies to versions that have been reviewed and tested. - Use a lockfile and require cryptographic hashes for downloaded Python packages. - Document the expected source, version, and checksums of components installed by `browser-use install`. - Install dependencies in an isolated virtual environment without administrator privileges. - Prefer an internal or otherwise trusted package mirror with provenance verification. - Periodically review and deliberately update dependency pins rather than automatically resolving the latest versions. - Run the browser automation process with only the filesystem and browser-profile access needed to generate the summary. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:54
Finding
Email Password Exposed Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 54 **Vulnerability Type**: Plaintext secret supplied through a command-line argument **Risk Level**: Medium ### Evidence ```bash browser-use input <password_input_index> "your-password" ``` ### Technical Analysis The manual login example instructs the user to substitute an email password directly into a shell command. A real password entered this way may be stored in shell history, captured by terminal recording or support tooling, exposed in copied command transcripts, or temporarily visible through process inspection depending on how the CLI handles its arguments. This conflicts with the document's later recommendation not to store passwords in plaintext. Even if the browser automation tool does not persist the password itself, placing the secret in the command line creates exposure outside the tool's control. ### Attack Path 1. The user replaces the placeholder with a real mailbox password. 2. The shell records the command in history, or another local monitoring mechanism captures the command line. 3. A local user, malicious process, backup reader, or support operator obtains the recorded command. 4. The exposed credential is used to authenticate to the mailbox. 5. If multifactor authentication is absent, bypassed, or separately compromised, the attacker obtains mailbox access. ### Impact Assessment Exposure may permit unauthorized access to the user's email account, including reading sensitive messages, resetting passwords for other services, impersonating the user, and accessing attachments or account recovery communications. The exact impact depends on provider controls such as multifactor authentication, login alerts, and session restrictions. The vulnerable example does not itself provide elevated operating-system privileges. ]]>
Remediation
<![CDATA[ ## Remediation Suggestions - Remove the example that passes a password as a command-line argument. - Prefer provider-supported OAuth authorization or reuse of a browser session established manually by the user. - If direct password entry is unavoidable, obtain it through a non-echoing interactive prompt that does not place the value in process arguments or shell history. - Use the operating system's credential manager for any credential that must be retained. - Ensure passwords are never included in logs, screenshots, generated summaries, environment dumps, or command transcripts. - Advise users who previously entered passwords through the documented command to remove exposed history securely and rotate the affected credential. - Retain and strengthen the recommendation to enable multifactor authentication. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill instructs users to type their email password directly into a shell command, which can expose credentials through shell history, terminal scrollback, process inspection, logging, or agent transcripts. In the context of email access, compromise of the password can lead to full mailbox takeover and potentially account recovery abuse across other services.

Ssd 3

High
Confidence
97% confidence
Finding
The skill explicitly directs collection and preservation of mailbox contents and screenshots into local files and reports. Because email data commonly contains sensitive personal, business, and security-related information, this creates a meaningful data exposure path even without network exfiltration code.

Ssd 3

High
Confidence
98% confidence
Finding
The AI-summary step instructs extraction of sender, subject, and message summary from live mailbox contents, which exposes private communications to an AI processing workflow and potentially to external services depending on tool configuration. In the context of email, even summarized content can reveal confidential business, financial, or personal information.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill recommends saving screenshots of inbox contents without warning that screenshots may capture sensitive email subjects, senders, previews, or other private information. These files can persist locally, be synced to cloud backups, or be accessed by other users/processes on the system.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill recommends scheduled automated execution against personal email accounts, creating recurring access to private mailbox data and likely generating local artifacts such as logs and screenshots. Persistent automation increases the blast radius of session misuse and privacy exposure if the host or stored outputs are compromised.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# 编辑 crontab
crontab -e

# 添加每日早上 9 点执行的任务
0 9 * * * /path/to/email_daily_summary.sh >> /path/to/logs/email_summary.log 2>&1
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
### macOS (launchd)

创建 `~/Library/LaunchAgents/com.email.dailysummary.plist`：

```xml
<?xml version="1.0" encoding="UTF-8"?>
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
### macOS (launchd)

创建 `~/Library/LaunchAgents/com.email.dailysummary.plist`：

```xml
<?xml version="1.0" encoding="UTF-8"?>
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
### macOS (launchd)

创建 `~/Library/LaunchAgents/com.email.dailysummary.plist`：

```xml
<?xml version="1.0" encoding="UTF-8"?>
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
### macOS (launchd)

创建 `~/Library/LaunchAgents/com.email.dailysummary.plist`：

```xml
<?xml version="1.0" encoding="UTF-8"?>
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
<key>StandardErrorPath</key>
    <string>/tmp/email_summary_error.log</string>
</dict>
</plist>
```

加载任务：
Confidence
90% confidence
Finding
The launchd example writes stdout and stderr to /tmp log files, which may capture mailbox metadata, page state, errors, or other sensitive details in a world-accessible or weakly protected temporary location. In the context of email automation, logging to /tmp materially increases the chance of local data exposure.

Session Persistence

Medium
Category
Rogue Agent
Content
加载任务：
```bash
launchctl load ~/Library/LaunchAgents/com.email.dailysummary.plist
```

## 输出示例
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
Most user-facing instructions in the skill are presented in Chinese, which can impose a language requirement on users without opt-in. The policy requires avoiding forced language or locale constraints unless users are given a choice or the restriction is clearly justified.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
The manifest describes a browser-based email summarization skill, and the documented implementation primarily uses browser-use to reuse logged-in sessions or perform manual login in the browser. Advising use of environment variables for sensitive data introduces a credential-handling capability outside the obvious scope of the stated purpose and beyond what this skill otherwise documents as necessary.