Is leli1024/lel-mail safe?
https://github.com/openclaw/skills/tree/main/skills/leli1024/lel-mail
lel-mail creates a critical prompt injection attack surface by injecting raw inbound email content (subject, sender, body) directly into LLM prompts that control agent actions including persistent memory writes, user notifications, and outgoing email composition — any attacker who can send an email to the monitored address can silently poison the agent's long-term memory, initiate unsolicited user contact, and exfiltrate information via the email reply mechanism. The skill additionally installs a randomized-delay cron daemon for persistent background execution and requires storing email credentials in plaintext. While the installation process itself was clean and no canary files were compromised, the runtime architecture of this skill is fundamentally unsafe for use with an autonomous agent that has tool access.
Category Scores
Findings (12)
CRITICAL Unsanitized Email Body Injected Directly Into LLM Prompt -45 ▶
check_email.sh constructs an LLM classification prompt by directly f-string interpolating the raw IMAP email subject, From header, and body without any escaping or sandboxing. The resulting prompt is passed verbatim to openclaw agent --message. An attacker who sends a crafted email can control the LLM's output JSON, selecting any action (add_memory, notify_user, to_respond) and supplying an arbitrary payload. Because the prompt explicitly asks for a JSON object, a well-crafted email body can bypass LLM reasoning entirely by supplying a pre-formed JSON response that the script parses with json.loads(stdout).
CRITICAL Persistent Agent Memory Poisoning via Email-Triggered add_memory -20 ▶
When the LLM returns action=add_memory, the payload field is passed directly to a second openclaw agent call: 'The following information needs to be logged: {memory_to_add}'. This agent is instructed to write to MEMORY.md files for the targeted user. An attacker can cause the agent to permanently inject false credentials, backdoor instructions, or manipulated context into the agent's persistent memory by sending a single email. The poisoned memory survives agent restarts and affects all future sessions.
HIGH Attacker-Controlled Agent Outreach and Email Composition via to_respond -12 ▶
The to_respond action triggers the agent to locate the user's active sessions (by scanning memory and USERS.md), contact them directly, and then send an outgoing email via the lel-mail skill. The scenario description and required inputs are entirely attacker-supplied. This creates a social-engineering amplification loop: the attacker seeds the situation via inbound email, the agent independently gathers additional sensitive inputs from the user, then closes the loop by sending an attacker-directed outgoing email.
HIGH Autonomous Email Exfiltration Channel via to_respond Loop -30 ▶
The to_respond action chain (inbound email → agent contacts user → agent sends outgoing email) provides an attacker with a functional data exfiltration path. A crafted inbound email can instruct the agent to include agent memory contents, environment details, or other sensitive context in the outgoing reply. The agent uses the lel-mail sending infrastructure already authenticated with the user's email credentials, making the exfiltration appear as legitimate user email.
HIGH Plaintext Email Credential Storage Required by Design -15 ▶
The skill requires storing SMTP and IMAP passwords in cleartext JSON at ~/.config/lel-mail/config.json. The README template explicitly shows the password field populated. Any agent skill, process, or user with filesystem read access can harvest these credentials. Gmail App Passwords, which are recommended, function as full account access tokens.
HIGH Persistent Randomized-Delay Cron Daemon Installation -25 ▶
SKILL.md instructs the agent to install a cron job running email_sender_daemon.sh every 5 minutes. The daemon itself introduces a random 30-90 second delay before each SMTP transmission. This randomization reduces detectability via timing analysis. The cron job persists indefinitely, survives agent restarts, and continues autonomous operation even if the user revokes the skill.
HIGH Subprocess Agent Spawn with Attacker-Controlled Prompts -15 ▶
check_email.sh uses subprocess.Popen to spawn openclaw agent processes with prompts derived from inbound email content. The spawned agents inherit the same tool access as the parent and execute with the user's credentials. This escalates a prompt injection vulnerability to full agent tool invocation — any tool available to the user's agent (filesystem, shell, network, browser) becomes accessible to the attacker via a crafted inbound email.
MEDIUM USERS.md Reconnaissance Directive Expands Access Scope -8 ▶
SKILL.md instructs the agent to read USERS.md or equivalent user-reference files to discover which email addresses to monitor. This is not limited to a specific path — the instruction 'or whatever USER reference file your system uses' encourages the agent to locate and read system user metadata beyond the skill's stated purpose. Combined with the notify_user and to_respond handlers, this reconnaissance data directly feeds into attacker-controlled outreach decisions.
MEDIUM Shell Variable Interpolation Into Python Heredoc Without Sanitization -15 ▶
email_send.sh assigns CLI arguments to shell variables (SENDER, RECIPIENT, SUBJECT, BODY, CC, BCC) and then embeds them directly into a Python heredoc using ${VAR} expansion. If any argument contains triple-quote sequences, newlines that break the Python string context, or other metacharacters, the embedded Python code can be corrupted or manipulated. An agent invoking this script with user-supplied email content could inadvertently execute attacker-injected Python.
LOW Tailscale Bypass Recommendation for Cloud Email Controls -5 ▶
The skill documentation advises users on cloud or VPS environments to use Tailscale to bypass provider-level email sending restrictions. While presented as a usability tip, this recommendation actively encourages circumventing network security controls imposed by infrastructure providers to block outbound SMTP abuse.
INFO Clean Sparse-Checkout Installation — No Unexpected Behavior 0 ▶
Installation consisted solely of git clone with depth=1, sparse-checkout set, git checkout, cp -r, and rm -rf of the temporary clone directory. No post-install hooks, pre-install scripts, setuid binaries, or symlinks pointing outside the skill directory were detected. No network connections attributable to skill code occurred during installation.
INFO Canary File Accesses Attributable to Audit Harness, Not Skill Code 0 ▶
Canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) appear in auditd PATH records at two time clusters: t≈1771952706 (before git clone at t≈1771952711 — audit setup baseline) and t≈1771952724 (post-install canary integrity verification by audit system). No PATH or EXECVE events link these accesses to skill scripts. All canary files confirmed intact with no content modifications.