Security Audit
21-DOT-DEV/openclaw-skills:skills/proton-mail-bridge
github.com/21-DOT-DEV/openclaw-skillsTrust Assessment
21-DOT-DEV/openclaw-skills:skills/proton-mail-bridge received a trust score of 75/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Potential Shell Command Injection, Prompt Injection Risk via Email Content, Data Exfiltration Channel via Outbound Email.
The analysis covered 4 layers: llm_behavioral_safety, manifest_analysis, static_code_analysis, dependency_graph. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 8, 2026 (commit fb9baad0). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Shell Command Injection The skill instructs the agent to execute `himalaya` commands using shell features like input redirection (`<`) and quoted search queries (`-q`). If the agent constructs these command strings using unsanitized input (e.g., from email subjects or user prompts containing shell metacharacters), it allows for arbitrary command execution. The reliance on shell syntax for operations like `himalaya message send ... < message.eml` necessitates running commands through a shell, increasing the attack surface. Ensure the agent uses an execution method that bypasses the shell (e.g., `execv` style with argument arrays) and avoids shell features like redirection (`<`, `|`) in favor of passing data via stdin programmatically. Sanitize all dynamic inputs used in command arguments. | Unknown | SKILL.md:118 | |
| MEDIUM | Prompt Injection Risk via Email Content The skill explicitly enables the agent to read and process email bodies (`himalaya message read`). Email content is untrusted external input that may contain prompt injection attacks (e.g., 'Ignore previous instructions...'). While the documentation warns to treat email as untrusted, the act of ingesting this content into the LLM context creates an inherent risk of the agent being manipulated into performing unauthorized actions. Implement strict output validation and sandboxing. Ensure the agent cannot execute high-privilege actions (like sending emails or accessing files) solely based on instructions found within the content it reads. Use a separate, lower-privilege context for parsing untrusted content if possible. | Unknown | SKILL.md:123 | |
| MEDIUM | Data Exfiltration Channel via Outbound Email The skill provides the capability to send emails (`himalaya message send`). If the agent is compromised (e.g., via prompt injection from an inbound email), this function serves as a direct exfiltration channel for sensitive data, environment variables, or local files. The 'human approval' mitigation relies on the agent correctly presenting the draft, which a compromised agent might bypass or obfuscate. Enforce strict rate limiting and allowlisting of destination addresses at the infrastructure level, not just the agent level. Require an out-of-band confirmation mechanism that displays the full raw content of the email to the user before the `himalaya` command is actually executed. | Unknown | SKILL.md:136 |
Scan History
Embed Code
[](https://skillshield.io/report/3aa94984729e5f13)
Powered by SkillShield