Skills/PyPI/mcp-mail

mcp-mail@0.1.19

CAUTION· install only

Publisher claims: "Coordinated multi-agent messaging and coordination MCP server." Observed in sandbox: calls astral.sh only, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher jleechanorg · publishing for 422 daysInstalls 103Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

Code inventory arrives with this version's next honeypot run.
It will ask for
unknown until the next run
Where it talks to
unknown until the next run
What the honeypot saw
no credential files read · reached only astral.sh
What we could not test
use of the skill by an agent

Not enough was observed to say yet. Install scripts ran; no agent task scenario for this bundle. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try mcp-mail` runs it now and prints the full answer.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-08 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: calls astral.sh only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 2 scenarios
t+CategoryObserved action
0.0sprocessexited 1: uv is required. Install via https://github.com/astral-sh/uv
0.1snetworkCONNECT https://astral.sh · not in the allow-list, refused
0.1sprocessexec /usr/bin/curl
0.1sprocessexited 22: curl: (22) The requested URL returned error: 403
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexited 1: uv is required. Install via https://github.com/astral-sh/uv
0.3snetworkCONNECT https://astral.sh · not in the allow-list, refused
0.3sprocessexec /usr/bin/curl
0.3sprocessexited 22: curl: (22) The requested URL returned error: 403

Static findings

CRITICAL
Pipe-to-shell patternscripts/run_server_pypi.sh:50 · Pipe-to-shell pattern — downloads and immediately executes remote codeecho "Install with: curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternscripts/run_server_local_build.sh:63 · Pipe-to-shell pattern — downloads and immediately executes remote codeecho "Install with: curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternscripts/install.sh:13 · Pipe-to-shell pattern — downloads and immediately executes remote code# curl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternscripts/install.sh:52 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --port 9000 --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Destructive command against a filesystem root or devicescripts/lib.sh:93 · Destructive command against a filesystem root or devicetrap "rm -f \"$tmp\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicescripts/lib.sh:356 · Destructive command against a filesystem root or devicetrap "rm -f \"$tmp\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternscripts/install.sh:403 · Pipe-to-shell pattern — downloads and immediately executes remote codeif ! curl -fsSL "${BEADS_INSTALL_URL}" | bash; thenFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Destructive command against a filesystem root or devicescripts/install.sh:307 · Destructive command against a filesystem root or devicetrap "rm -f \"${tmp}\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternscripts/claude_start.sh:1249 · Pipe-to-shell pattern — downloads and immediately executes remote codeecho -e "${BLUE}💡 Install Ollama: curl -fsSL https://ollama.com/install.sh | sh${NC}"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternscripts/install.sh:51 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternscripts/install.sh:237 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsscripts/bootstrap.sh:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesgrep -E '^(HTTP_|DATABASE_URL|STORAGE_ROOT|LLM_|OPENAI_API_KEY|ANTHROPIC_API_KEY|GOOGLE_API_KEY|GROK_API_KEY|XAI_API_KEY)=' .env | sed -E 's/=(.*)$/=***REDACTED***/'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/auto_register_agent.sh:242 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load bearer token from environment or .env filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/deploy.sh:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = Path('.env')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/codex_with_registration.sh:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_token_from_file "${REPO_ROOT}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/codex_with_registration.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_token_from_file "${HOME}/.config/mcp-agent-mail/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/generate_slack_app_url.py:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint(" 6. Add both to your .env file:")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/bootstrap.sh:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f .env ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/auto_register_agent.sh:244 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Try: 1. Env var, 2. ~/.mcp_mail/credentials.json, 3. Repo .env, 4. Config .env, 5. Legacy .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/deploy.sh:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesgrep -E '^(HTTP_|DATABASE_URL|STORAGE_ROOT|LLM_|OPENAI_API_KEY|ANTHROPIC_API_KEY|GOOGLE_API_KEY|GROK_API_KEY|XAI_API_KEY)=' .env | sed -E 's/=(.*)$/=***REDACTED***/'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/bootstrap.sh:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp deploy/env/example.env .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/deploy.sh:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f .env ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/claude_start.sh:63 · Privileged sudo command — agent may execute with elevated privilegesecho "Please install jq: sudo apt-get install jq (or equivalent for your OS)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/bootstrap.sh:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = Path('.env')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/deploy.sh:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "==> No .env found; copying from deploy/env/production.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedscripts/install.sh:307 · Destructive file system command detectedtrap "rm -f \"${tmp}\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/auto_register_agent.sh:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load HTTP_BEARER_TOKEN from a .env-style fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/deploy.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp deploy/env/production.env .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:301 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslocal env_file="${REPO_DIR}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/auto_register_agent.sh:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# HTTP_BEARER_TOKEN - Required for authentication (or loaded from .env)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/bootstrap.sh:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "==> No .env found; copying from deploy/env/example.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files--port PORT HTTP server port (default: 8765); sets HTTP_PORT in .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Direct script execution from GitHub raw URLscripts/install.sh:51 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --yesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:306 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Direct script execution from GitHub raw URLscripts/install.sh:27 · Direct script execution from GitHub raw URL — unverified code sourceBEADS_INSTALL_URL="https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_cline.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_cline.sh:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:317 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileserr "Failed to update HTTP_PORT in .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_cline.sh:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Reuse existing token if possible (INTEGRATION_BEARER_TOKEN > .env > run helper)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:307 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Direct script execution from GitHub raw URLscripts/install.sh:52 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --port 9000 --yesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsscripts/install.sh:304 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesinfo "Configuring HTTP_PORT=${HTTP_PORT_OVERRIDE} in .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:325 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileserr "Failed to append HTTP_PORT to .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_cline.sh:107 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Direct script execution from GitHub raw URLscripts/install.sh:13 · Direct script execution from GitHub raw URL — unverified code source# curl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --yesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsscripts/integrate_codex_cli.sh:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_cursor.sh:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_codex_cli.sh:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_codex_cli.sh:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_codex_cli.sh:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_cursor.sh:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_gemini_cli.sh:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_github_copilot.sh:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_cursor.sh:95 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_gemini_cli.sh:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_github_copilot.sh:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_gemini_cli.sh:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_cursor.sh:94 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_gemini_cli.sh:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_github_copilot.sh:200 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_opencode.sh:161 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_github_copilot.sh:199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_opencode.sh:160 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_opencode.sh:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_opencode.sh:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib.sh:505 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f ~/.config/mcp-agent-mail/.env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib.sh:351 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslocal key="$1"; local value="$2"; local env_file=".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedscripts/lib.sh:356 · Destructive file system command detectedtrap "rm -f \"$tmp\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_windsurf.sh:107 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedscripts/lib.sh:93 · Destructive file system command detectedtrap "rm -f \"$tmp\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_windsurf.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib.sh:349 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Update or append env var in .env atomically (backup first)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib.sh:506 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' ~/.config/mcp-agent-mail/.env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_windsurf.sh:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/integrate_windsurf.sh:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib.sh:352 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ "${DRY_RUN}" == "1" ]]; then _print "[dry-run] set ${key} in .env"; return 0; fiFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/setup-github-runner.sh:289 · Privileged sudo command — agent may execute with elevated privilegesecho "- Check status: sudo ./svc.sh status"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/setup-github-runner.sh:254 · Privileged sudo command — agent may execute with elevated privilegessudo ./svc.sh startFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/run_server_with_token.sh:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/run_server_with_token.sh:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/run_server_with_token.sh:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/run_server_with_token.sh:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSLACK_WEBHOOK_URL=$(grep -E '^SLACK_WEBHOOK_URL=' .env | sed -E 's/^SLACK_WEBHOOK_URL=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/setup-github-runner.sh:258 · Privileged sudo command — agent may execute with elevated privilegesif sudo ./svc.sh status; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/setup-github-runner.sh:251 · Privileged sudo command — agent may execute with elevated privilegessudo ./svc.sh installFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/setup_slack_bot.sh:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE="$PROJECT_ROOT/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup_slack_bot.sh:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint_info "Creating .env file..."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/setup-github-runner.sh:290 · Privileged sudo command — agent may execute with elevated privilegesecho "- Stop service: sudo ./svc.sh stop"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/setup_slack_bot.sh:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint_success ".env file exists at $ENV_FILE"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/share_to_github_pages.py:243 · Privileged sudo command — agent may execute with elevated privilegesconsole.print(" curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/share_to_github_pages.py:244 · Privileged sudo command — agent may execute with elevated privileges…s/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null') console.print(…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/setup_slack_bot.sh:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check if .env existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/config.py:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Create config that gracefully handles missing .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/share_to_github_pages.py:245 · Privileged sudo command — agent may execute with elevated privilegesconsole.print(" sudo apt update")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellscripts/claude_start.sh:1249 · Remote installer piped to shellecho -e "${BLUE}💡 Install Ollama: curl -fsSL https://ollama.com/install.sh | sh${NC}"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/config.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Get config value with precedence: env > credentials.json > .env > default."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/config.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 3. Fall through to decouple (handles .env and defaults)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/config.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_DOTENV_PATH: Final[Path] = Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/cli.py:2883 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: Annotated[Optional[Path], typer.Option(..., "--env-file", help="Path to .env file")] = None,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/llm.py:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Bridge provider keys from .env to environment for LiteLLMFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/cli.py:2921 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestemp_fd, temp_path = tempfile.mkstemp(dir=env_path.parent, prefix=".env.tmp.", text=True)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/cli.py:2885 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Set HTTP_PORT in .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/claude_start.sh:85 · File permission modification command — agent changes file ownership/permissionschmod 700 "$PID_DIR" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/llm.py:253 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Populate os.environ with provider API keys from .env via decouple if missing.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/share_to_github_pages.py:249 · Privileged sudo command — agent may execute with elevated privilegesconsole.print(" sudo dnf install 'dnf-command(config-manager)'")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/cli.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesDEFAULT_ENV_PATH = Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/claude_start.sh:206 · File permission modification command — agent changes file ownership/permissionschmod +x "$WORLDARCHITECT_HOME/claude_backup.sh"; thenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/llm.py:258 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdotenv_path = Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_agent_mail/config.py:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. .env file in current directory (for development)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/share_to_github_pages.py:246 · Privileged sudo command — agent may execute with elevated privilegesconsole.print(" sudo apt install gh -y")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/claude_start.sh:261 · File permission modification command — agent changes file ownership/permissionschmod +x "$HOME/.local/bin/claude_backup_wrapper.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/claude_start.sh:91 · Process kill command — agent can terminate processesif kill -0 "$PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/claude_start.sh:277 · File permission modification command — agent changes file ownership/permissionschmod +x "$WORLDARCHITECT_HOME/orchestration/cleanup_completed_agents.py"; thenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/claude_start.sh:1363 · Process kill command — agent can terminate processeskill $PROXY_PID 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/install-git-hooks.sh:67 · File permission modification command — agent changes file ownership/permissionschmod +x "$destination"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/claude_start.sh:301 · File permission modification command — agent changes file ownership/permissionschmod +x "$HOME/.local/bin/tmux_cleanup_wrapper.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/claude_start.sh:162 · Process kill command — agent can terminate processesif ! kill -0 $START_PID 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/claude_start.sh:92 · Process kill command — agent can terminate processeskill "$PID" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellscripts/install.sh:51 · Remote installer piped to shellcurl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellscripts/install.sh:13 · Remote installer piped to shell# curl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)scripts/integrate_claude_code.sh:226 · MCP server using network transport (SSE/HTTP) — data sent over network'.mcpServers = (.mcpServers // {}) | .mcpServers["mcp-agent-mail"] = {"type":"http","url":$url,"core":true,"headers":{"Authorization": ("Bearer " + $token)}}' \Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandscripts/lib.sh:172 · File permission modification command — agent changes file ownership/permissions_print "[dry-run] chmod 600 ${file}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install.sh:507 · File permission modification command — agent changes file ownership/permissionsecho " chmod 600 ~/.mcp_mail/credentials.json"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellscripts/install.sh:237 · Remote installer piped to shellcurl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandscripts/lib.sh:179 · File permission modification command — agent changes file ownership/permissionsif ! chmod 600 "$file" 2>/dev/null; thenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/lib.sh:196 · File permission modification command — agent changes file ownership/permissionsif ! chmod 700 "$file" 2>/dev/null; thenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellscripts/install.sh:52 · Remote installer piped to shellcurl -fsSL https://raw.githubusercontent.com/jleechanorg/mcp_mail/main/scripts/install.sh | bash -s -- --port 9000 --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandscripts/lib.sh:180 · File permission modification command — agent changes file ownership/permissionslog_warn "Failed to chmod 600 ${file} (permissions/readonly filesystem?)"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/lib.sh:189 · File permission modification command — agent changes file ownership/permissions_print "[dry-run] chmod 700 ${file}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install.sh:357 · File permission modification command — agent changes file ownership/permissionschmod 600 "${env_file}" 2>/dev/null || warn "Could not set .env permissions to 600"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellscripts/install.sh:403 · Remote installer piped to shellif ! curl -fsSL "${BEADS_INSTALL_URL}" | bash; thenFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Process kill commandscripts/lib.sh:456 · Process kill command — agent can terminate processesif [[ "${DRY_RUN}" == "1" ]]; then _print "[dry-run] kill -TERM ${to_kill[*]}"; return 0; fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/lib.sh:437 · Process kill command — agent can terminate processes# Gracefully kill a list of PIDs owned by current user; escalate to KILL after timeoutFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellscripts/run_server_local_build.sh:63 · Remote installer piped to shellecho "Install with: curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/app.py:153 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/lib.sh:462 · Process kill command — agent can terminate processesif kill -0 "$pid" 2>/dev/null; then alive+=("$pid"); fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:232 · Python subprocess execution detectedsubprocess.run(["brew", "install", "gh"], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:260 · Python subprocess execution detectedsubprocess.run(["gh", "--version"], capture_output=True, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/share_to_github_pages.py:637 · Process kill command — agent can terminate processesprocess.wait() # Wait for kill to completeFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/test_rich_output.py:11 · File permission modification command — agent changes file ownership/permissionschmod +x scripts/test_rich_output.pyFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/lib.sh:467 · Process kill command — agent can terminate processeskill -KILL "${alive[@]}" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellscripts/run_server_pypi.sh:50 · Remote installer piped to shellecho "Install with: curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:211 · Python subprocess execution detectedsubprocess.run(cmd, capture_output=True, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/setup_slack_bot.sh:137 · File permission modification command — agent changes file ownership/permissionschmod 600 "$CREDS_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/setup-github-runner.sh:26 · File permission modification command — agent changes file ownership/permissionschmod +x "$HOME_SCRIPT"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/resolve_conflicts.sh:21 · File permission modification command — agent changes file ownership/permissionschmod +x scripts/auto_resolve_conflicts.shFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/setup_slack_bot.sh:132 · File permission modification command — agent changes file ownership/permissionschmod 700 "$CREDS_DIR"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/lib.sh:457 · Process kill command — agent can terminate processeskill -TERM "${to_kill[@]}" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:190 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/app.py:128 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:138 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/share.py:1886 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True, text=True, input=input_text)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/claude_start.sh:1251 · Process kill command — agent can terminate processeskill $PROXY_PID 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:658 · Python subprocess execution detectedresult = subprocess.run(command, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:2229 · Python subprocess execution detectedrc = subprocess.run(list(cmd), env=env, check=False).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:1639 · Python subprocess execution detectedresult = subprocess.run([sys.executable, str(wizard_script)], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_agent_mail/cli.py:3123 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file"""Detect AGENTS.md/CLAUDE.md files and append the latest Agent Mail + Beads blurbs."""Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/app.py:170 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:420 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file## Ready-Made Blurb to Add to Your AGENTS.md or CLAUDE.md Files:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:2413 · Python subprocess execution detectedcp = subprocess.run(["git", "-C", str(path), *args], check=True, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/share.py:570 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:2344 · Python subprocess execution detectedcp = subprocess.run(["git", "-C", str(cwd), *args], check=True, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:414 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file… have the mail tool available. See below for a ready-made chunk of text you can add to the end of your existing AGENTS.md or CLAUDE.md files to help your agents better utilize the new tools. # Change port after in…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈50 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for mcp-mail@0.1.19 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Unclaimed publisher≈ +8 on the totalClaim jleechanorg: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jleechanorgPropose a patch to the maintainer