mseep-mcp-agent-mail@0.1.0
CAUTION· install onlyPublisher claims: "Coordinated multi-agent messaging and coordination MCP server." Observed in sandbox: calls astral.sh only, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher mseep-support · publishing for 578 daysInstalls 11Last detonated 2d ago
Coverage
Install scripts ran; no agent task scenario for this bundle.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
HTTP_BEARER_TOKENINTEGRATION_BEARER_TOKENINTEGRATION_TOKENMASKED_TOKENREGENERATE_TOKENSHOW_TOKENor--regenerate-token/--show-tokenConfiguration, not credentials: AGENT_MAIL_GUARD_MODE, AGENT_NAME, HOME_SETTINGS_PATH, LOCAL_SETTINGS_PATH, PROJECT_KEY, REPO_PATH, SETTINGS_PATH- Where it talks to
- no vendor host named in the codeAlso githubusercontent.com, astral.sh, visualstudio.com, opencode.ai, nodejs.org, web.dev — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · reached only astral.sh
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubusercontent.com, astral.sh, visualstudio.com, opencode.ai, nodejs.org, web.dev as well as its own vendor. The guard injects HTTP_BEARER_TOKEN, INTEGRATION_BEARER_TOKEN, INTEGRATION_TOKEN, MASKED_TOKEN, REGENERATE_TOKEN, SHOW_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- uvx mseep-mcp-agent-mail
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-12 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: calls astral.sh only, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenariost+CategoryObserved action
0.0sprocessexited 1: uv is required. Install via https://github.com/astral-sh/uv
0.1snetworkCONNECT tcp://astral.sh:443 · not in the allow-list, refused
0.1sprocessexec /usr/bin/curl
0.1sprocessexited 22: curl: (22) The requested URL returned error: 403
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset
0.1sprocessexited 1: uv is required. Install via https://github.com/astral-sh/uv
0.2snetworkCONNECT tcp://astral.sh:443 · not in the allow-list, refused
0.2sprocessexec /usr/bin/curl
0.2sprocessexited 22: curl: (22) The requested URL returned error: 403
Static findings
CRITICAL
Pipe-to-shell patternscripts/install.sh:55 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patternscripts/install.sh:420 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patternscripts/install.sh:56 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --port 9000 --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patternscripts/install.sh:13 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06# curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Destructive command against a filesystem root or devicescripts/install.sh:541 · Destructive command against a filesystem root or device
AST05trap "rm -f \"${tmp}\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CRITICAL
Pipe-to-shell patternscripts/install.sh:645 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06if ! curl -fsSL "${BEADS_INSTALL_URL}" | bash; thenFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Destructive command against a filesystem root or devicescripts/lib.sh:93 · Destructive command against a filesystem root or device
AST05trap "rm -f \"$tmp\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/automatically_detect_all_installed_coding_agents_and_install_mcp_agent_mail_in_all.sh:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/bootstrap.sh:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05grep -E '^(HTTP_|DATABASE_URL|STORAGE_ROOT|LLM_|OPENAI_API_KEY|ANTHROPIC_API_KEY|GOOGLE_API_KEY|GROK_API_KEY|XAI_API_KEY)=' .env | sed -E 's/=(.*)$/=***REDACTED***/'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsAGENTS.md:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…PYTHON_BEST_PRACTICES.md`. We load all configuration details from the existing .env file (even if you can't see this file, it DOES exist, and must NEVER be overwri…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/install.sh:553 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05err "Failed to update HTTP_PORT in .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsAGENTS.md:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- Set `WORKTREES_ENABLED=1` or `GIT_IDENTITY_ENABLED=1` in `.env` (do not commit secrets; config is loaded via `python-decouple`).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/bootstrap.sh:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo "==> No .env found; copying from deploy/env/example.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/install.sh:535 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05local env_file="${REPO_DIR}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/deploy.sh:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env = Path('.env')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/bootstrap.sh:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env = Path('.env')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/deploy.sh:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05grep -E '^(HTTP_|DATABASE_URL|STORAGE_ROOT|LLM_|OPENAI_API_KEY|ANTHROPIC_API_KEY|GOOGLE_API_KEY|GROK_API_KEY|XAI_API_KEY)=' .env | sed -E 's/=(.*)$/=***REDACTED***/'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/install.sh:543 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Set secure umask for .env file operations, save original to restore laterFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Pipe-to-shell patternAGENTS.md:291 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06**Install:** `curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh | bash`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedscripts/install.sh:541 · Destructive file system command detected
AST05trap "rm -f \"${tmp}\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/deploy.sh:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo "==> No .env found; copying from deploy/env/production.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLAGENTS.md:291 · Direct script execution from GitHub raw URL — unverified code source
AST06**Install:** `curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh | bash`Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsscripts/automatically_detect_all_installed_coding_agents_and_install_mcp_agent_mail_in_all.sh:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05EXISTING=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/install.sh:538 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05info "Configuring HTTP_PORT=${HTTP_PORT_OVERRIDE} in .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/bootstrap.sh:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [ ! -f .env ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Destructive command against a filesystem root or devicescripts/lib.sh:356 · Destructive command against a filesystem root or device
AST05trap "rm -f \"$tmp\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/install.sh:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05--port PORT HTTP server port (default: 8765); sets HTTP_PORT in .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/bootstrap.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05cp deploy/env/example.env .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/deploy.sh:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [ ! -f .env ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/automatically_detect_all_installed_coding_agents_and_install_mcp_agent_mail_in_all.sh:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Persist token to .env for consistency across tools (non-destructive)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/deploy.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05cp deploy/env/production.env .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsAGENTS.md:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05decouple_config = DecoupleConfig(RepositoryEnv(".env"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLscripts/install.sh:13 · Direct script execution from GitHub raw URL — unverified code source
AST06# curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --yesFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsscripts/integrate_gemini_cli.sh:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_opencode.sh:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Reuse existing token if possible (INTEGRATION_BEARER_TOKEN > .env > run helper)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLscripts/install.sh:55 · Direct script execution from GitHub raw URL — unverified code source
AST06curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --yesFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsscripts/integrate_codex_cli.sh:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_cursor.sh:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_gemini_cli.sh:95 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_github_copilot.sh:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_cline.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_opencode.sh:160 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_opencode.sh:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_gemini_cli.sh:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_cursor.sh:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_cursor.sh:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_cline.sh:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_cline.sh:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLscripts/install.sh:56 · Direct script execution from GitHub raw URL — unverified code source
AST06curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --port 9000 --yesFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsscripts/integrate_codex_cli.sh:98 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_github_copilot.sh:191 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_opencode.sh:161 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_cursor.sh:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_github_copilot.sh:192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_gemini_cli.sh:94 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_github_copilot.sh:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:220 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLscripts/install.sh:28 · Direct script execution from GitHub raw URL — unverified code source
AST06BEADS_INSTALL_URL="https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsscripts/integrate_codex_cli.sh:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_cline.sh:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_codex_cli.sh:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_claude_code.sh:219 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_windsurf.sh:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLscripts/install.sh:29 · Direct script execution from GitHub raw URL — unverified code source
AST06BV_INSTALL_URL="https://raw.githubusercontent.com/Dicklesworthstone/beads_viewer/main/install.sh"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsscripts/integrate_windsurf.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -z "${_TOKEN}" && -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/lib.sh:352 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ "${DRY_RUN}" == "1" ]]; then _print "[dry-run] set ${key} in .env"; return 0; fiFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/lib.sh:351 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05local key="$1"; local value="$2"; local env_file=".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/share_to_github_pages.py:311 · Privileged sudo command — agent may execute with elevated privileges
AST05console.print(" curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/run_server_with_token.sh:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/share_to_github_pages.py:313 · Privileged sudo command — agent may execute with elevated privileges
AST05console.print(" sudo apt update")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Destructive file system command detectedDockerfile:79 · Destructive file system command detected
AST05&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shellAGENTS.md:291 · Remote installer piped to shell
AST07**Install:** `curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh | bash`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/config.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Gracefully handle missing .env (e.g., in CI/tests) by falling back to an empty repositoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_windsurf.sh:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/config.py:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Fall back to an empty repository (reads only os.environ; all .env lookups use defaults)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandscripts/automatically_detect_all_installed_coding_agents_and_install_mcp_agent_mail_in_all.sh:189 · Process kill command — agent can terminate processes
AST05# Also kill any other processes on port 8765 (cross-platform: uses lsof on macOS, fuser on Linux)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shellDockerfile:14 · Remote installer piped to shell
AST07RUN curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedscripts/lib.sh:93 · Destructive file system command detected
AST05trap "rm -f \"$tmp\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/cli.py:3738 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Set HTTP_PORT in .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/share_to_github_pages.py:317 · Privileged sudo command — agent may execute with elevated privileges
AST05console.print(" sudo dnf install 'dnf-command(config-manager)'")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/llm.py:232 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Populate os.environ with provider API keys from .env via decouple if missing.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/run_server_with_token.sh:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Pipe-to-shell patternDockerfile:14 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06RUN curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellscripts/install.sh:13 · Remote installer piped to shell
AST07# curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/llm.py:239 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Gracefully handle missing .env file (e.g., in CI/tests)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Remote installer piped to shellscripts/install.sh:56 · Remote installer piped to shell
AST07curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --port 9000 --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/config.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_DOTENV_PATH: Final[Path] = Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/cli.py:3736 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env_file: Annotated[Optional[Path], typer.Option("--env-file", help="Path to .env file")] = None,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/llm.py:241 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05cfg = DecoupleConfig(RepositoryEnv(".env"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Remote installer piped to shellscripts/install.sh:55 · Remote installer piped to shell
AST07curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh | bash -s -- --yesFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/automatically_detect_all_installed_coding_agents_and_install_mcp_agent_mail_in_all.sh:183 · Process kill command — agent can terminate processes
AST05# Exact restart behavior requested: kill 8765/tcp and start server in foreground with full outputFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/llm.py:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Bridge provider keys from .env to environment for LiteLLMFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandDockerfile:35 · File permission modification command — agent changes file ownership/permissions
AST05mkdir -p /data/mailbox && chown -R appuser:appuser /data /appFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/cli.py:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05DEFAULT_ENV_PATH = Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathscompose.yaml:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- ./.env:/app/.env:roFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/share_to_github_pages.py:312 · Privileged sudo command — agent may execute with elevated privileges
AST05…s/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null') console.print(…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/share_to_github_pages.py:314 · Privileged sudo command — agent may execute with elevated privileges
AST05console.print(" sudo apt install gh -y")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Destructive file system command detectedscripts/lib.sh:356 · Destructive file system command detected
AST05trap "rm -f \"$tmp\" 2>/dev/null" EXIT INT TERMFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandscripts/install.sh:598 · File permission modification command — agent changes file ownership/permissions
AST05chmod 600 "${env_file}" 2>/dev/null || warn "Could not set .env permissions to 600"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Remote installer piped to shellscripts/install.sh:420 · Remote installer piped to shell
AST07curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/install.sh:706 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${stub_path}" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Remote installer piped to shellscripts/install.sh:645 · Remote installer piped to shell
AST07if ! curl -fsSL "${BEADS_INSTALL_URL}" | bash; thenFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsscripts/lib.sh:349 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Update or append env var in .env atomically (backup first)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
MCP server using network transport (SSE/HTTP)scripts/integrate_claude_code.sh:173 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04'.mcpServers = (.mcpServers // {}) | .mcpServers["mcp-agent-mail"] = {"type":"http","url":$url,"headers":{"Authorization": ("Bearer " + $token)}}' \Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.HIGH
Access to sensitive file pathsscripts/run_server_with_token.sh:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Prefer an existing env var; otherwise read from .env; otherwise generate ephemeral for this processFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/integrate_windsurf.sh:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HTTP_BEARER_TOKEN=$(grep -E '^HTTP_BEARER_TOKEN=' .env | sed -E 's/^HTTP_BEARER_TOKEN=//') || trueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandDockerfile:93 · File permission modification command — agent changes file ownership/permissions
AST05chown -R appuser:appuser /opt/mcp-agent-mailFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Destructive file system command detectedDockerfile:11 · Destructive file system command detected
AST05rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Access to sensitive file pathscompose.yaml:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Optional: mount a local .env file (read-only) for configFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Destructive file system command detectedDockerfile:56 · Destructive file system command detected
AST05&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/mcp_agent_mail/cli.py:3775 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05dir=env_path.parent, prefix=".env.tmp.", text=TrueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:604 · Python subprocess execution detected
AST05result = subprocess.run(command, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
HTML comment carrying imperative instructions to the agentsrc/mcp_agent_mail/templates/mail_thread.html:62 · HTML comment carrying imperative instructions to the agent · informational: not an instruction file
AST01Message Header (Always Visible)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/share.py:1938 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True, text=True, input=input_text)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/lib.sh:437 · Process kill command — agent can terminate processes
AST05# Gracefully kill a list of PIDs owned by current user; escalate to KILL after timeoutFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandscripts/test_rich_output.py:11 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x scripts/test_rich_output.pyFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_agent_mail/cli.py:3982 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01"""Detect AGENTS.md/CLAUDE.md files and append the latest Agent Mail + Beads blurbs."""Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File permission modification commandscripts/lib.sh:179 · File permission modification command — agent changes file ownership/permissions
AST05if ! chmod 600 "$file" 2>/dev/null; thenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandscripts/lib.sh:456 · Process kill command — agent can terminate processes
AST05if [[ "${DRY_RUN}" == "1" ]]; then _print "[dry-run] kill -TERM ${to_kill[*]}"; return 0; fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:328 · Python subprocess execution detected
AST05subprocess.run(["gh", "--version"], capture_output=True, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/guard.py:155 · Python subprocess execution detected
AST05" co = subprocess.run([\"git\",\"diff\",\"--cached\",\"--name-only\",\"-z\",\"--diff-filter=ACMRDTU\"],",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:126 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01… have the mail tool available. See below for a ready-made chunk of text you can add to the end of your existing AGENTS.md or CLAUDE.md files to help your agents better utilize the new tools. # Change port after in…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/guard.py:162 · Python subprocess execution detected
AST05" cs = subprocess.run([\"git\",\"diff\",\"--cached\",\"--name-status\",\"-M\",\"-z\"],",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:279 · Python subprocess execution detected
AST05subprocess.run(cmd, capture_output=True, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/guard.py:68 · Python subprocess execution detected
AST05" return subprocess.run([str(path)], input=stdin_bytes, check=False).returncode",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/lib.sh:172 · File permission modification command — agent changes file ownership/permissions
AST05_print "[dry-run] chmod 600 ${file}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:2496 · Python subprocess execution detected
AST05cp = subprocess.run(["git", "-C", str(cwd), *args], check=True, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/guard.py:307 · Python subprocess execution detected
AST05" cp = subprocess.run([\"git\",\"rev-list\",\"--topo-order\",local_sha,\"--not\",f\"--remotes={remote}\"],",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/lib.sh:462 · Process kill command — agent can terminate processes
AST05if kill -0 "$pid" 2>/dev/null; then alive+=("$pid"); fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:300 · Python subprocess execution detected
AST05subprocess.run(["brew", "install", "gh"], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/lib.sh:467 · Process kill command — agent can terminate processes
AST05kill -KILL "${alive[@]}" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:206 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/lib.sh:189 · File permission modification command — agent changes file ownership/permissions
AST05_print "[dry-run] chmod 700 ${file}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:132 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01## Ready-Made Blurb to Add to Your AGENTS.md or CLAUDE.md Files:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:1686 · Python subprocess execution detected
AST05result = subprocess.run([sys.executable, str(wizard_script)], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/lib.sh:196 · File permission modification command — agent changes file ownership/permissions
AST05if ! chmod 700 "$file" 2>/dev/null; thenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedscripts/share_to_github_pages.py:258 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/share_to_github_pages.py:732 · Process kill command — agent can terminate processes
AST05process.wait() # Wait for kill to completeFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/guard.py:67 · Python subprocess execution detected
AST05" return subprocess.run(['python', str(path)], input=stdin_bytes, check=False).returncode",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/share.py:578 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/lib.sh:180 · File permission modification command — agent changes file ownership/permissions
AST05log_warn "Failed to chmod 600 ${file} (permissions/readonly filesystem?)"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
HTML that renders invisible but is read by the agentsrc/mcp_agent_mail/templates/mail_thread.html:59 · HTML that renders invisible but is read by the agent · informational: not an instruction file
AST01<!-- Message Header (Always Visible) --> <div @click="expanded = !expanded" class="p-5 cursor-pointer hover:bg-slate-50 dark:hover:bg-slate-900/50 transition-coFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:2926 · Python subprocess execution detected
AST05subprocess.run(["git", "-C", str(root), "add", str(marker_path)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcp_agent_mail/cli.py:2854 · Python subprocess execution detected
AST05rc = subprocess.run(list(cmd), env=env, check=False).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/lib.sh:457 · Process kill command — agent can terminate processes
AST05kill -TERM "${to_kill[@]}" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈5,481 tok
2 files · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for mseep-mcp-agent-mail@0.1.0 as of 2d ago. This is the package itself, not its dependencies.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Unclaimed publisher≈ +8 on the totalClaim mseep-support: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mseep-supportPropose a patch to the maintainer