中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:19 hr ago Rescan
20 /100
email-163-com
163 邮箱完整邮件管理工具 — Send/receive/search/manage emails via IMAP/SMTP
A legitimate 163 email client with documented installation methods involving curl|bash, but no malicious behavior found in the core skill implementation (main.py). The shell execution risk is limited to distribution documentation, not the skill itself.
Skill Nameemail-163-com
Duration43.8s
Enginepi
✓
Safe to install
Approve with caveats: (1) Replace placeholder URL in install.sh with a real, trusted endpoint before distribution; (2) Consider adding version pinning if external packages are ever added; (3) The curl|bash pattern is documented and visible in DISTRIBUTION.md, not hidden.

Findings 3 items

Severity Finding Location
Medium
curl|bash documented as distribution method Doc Mismatch
DISTRIBUTION.md:62 and install.sh:3 contain the pattern 'curl -L <URL> | bash' which is a well-known high-risk installation pattern. However, in this context it is documented as a user-facing distribution method (not hidden skill behavior), and the URL is a clearly marked placeholder 'your-server.com' rather than an active attacker-controlled endpoint.
curl -L https://your-server.com/email-163-com/install.sh | bash
→ Replace with a more secure distribution method such as direct git clone or signed package downloads.
 DISTRIBUTION.md:62
Low
Placeholder URL in install.sh Doc Mismatch
install.sh:8 uses 'https://your-server.com/email-163-com.tar.gz' as a placeholder. While clearly a template, if this were published without replacement it would point to a non-existent or attacker-controlled server.
SKILL_URL="https://your-server.com/email-163-com.tar.gz"
→ Replace with a real, trusted hosting URL before distribution.
 install.sh:8
Low
Config stores plaintext credentials Sensitive Access
The tool stores the 163 authorization code in plaintext in ~/.config/email-163-com/config.json. SKILL.md advises chmod 600 but the skill itself only sets this permission after save_config is called.
save_config() sets os.chmod(CONFIG_PATH, 0o600)
→ Consider supporting environment variables as the primary credential mechanism, or document that the file must be manually secured.
 SKILL.md:68
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned Reads ~/.config/email-163-com/config.json, writes to output_dir for attachments
Network READ READ ✓ Aligned IMAP/SMTP connections only to imap.163.com:993 and smtp.163.com:465
Shell NONE NONE — main.py uses no subprocess — only smtplib/imaplib from stdlib
Environment READ READ ✓ Aligned Reads EMAIL_163_USER / EMAIL_163_PASS env vars per SKILL.md documented interface
2 Critical 14 findings
💀
Critical Dangerous Command 危险 Shell 命令
curl -L https://your-server.com/email-163-com/install.sh | bash
DISTRIBUTION.md:62
💀
Critical Dangerous Command 危险 Shell 命令
curl -L <URL> | bash
install.sh:3
🔗
Medium External URL 外部 URL
https://your-server.com/email-163-com/install.sh
DISTRIBUTION.md:62
🔗
Medium External URL 外部 URL
https://clawhub.cn
DISTRIBUTION.md:76
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/email-163-com
PUBLIC-TEST-REPORT.md:486
🔗
Medium External URL 外部 URL
https://clawhub.ai/cli/auth
PUBLISH.md:78
🔗
Medium External URL 外部 URL
https://mail.163.com/
README-PACKAGE.md:52
🔗
Medium External URL 外部 URL
https://help.mail.163.com/
SKILL.md:327
🔗
Medium External URL 外部 URL
https://your-server.com/email-163-com.tar.gz
install.sh:8
🔗
Medium External URL 外部 URL
https://mail.163.com
main.py:119
📧
Info Email 邮箱地址
[email protected]
INSTALL.md:108
📧
Info Email 邮箱地址
[email protected]
PUBLIC-TEST-REPORT.md:467
📧
Info Email 邮箱地址
[email protected]
main.py:186
📧
Info Email 邮箱地址
[email protected]
main.py:805

File Tree

16 files · 91.0 KB · 3874 lines
Markdown 10f · 2846L Python 1f · 899L JSON 4f · 77L Shell 1f · 52L
├─ 📋 _meta.json JSON 5L · 132 B
├─ 📝 DISTRIBUTION.md Markdown 283L · 5.7 KB
├─ 📋 evomap-capsule.json JSON 12L · 558 B
├─ 📋 evomap-gene.json JSON 7L · 282 B
├─ 📝 INSTALL.md Markdown 172L · 3.4 KB
├─ 🔧 install.sh Shell 52L · 1.3 KB
├─ 🐍 main.py Python 899L · 31.8 KB
├─ 📋 package.json JSON 53L · 1.1 KB
├─ 📝 PUBLIC-TEST-REPORT.md Markdown 539L · 10.2 KB
├─ 📝 PUBLISH.md Markdown 239L · 4.8 KB
├─ 📝 README-PACKAGE.md Markdown 145L · 2.3 KB
├─ 📝 README.md Markdown 202L · 3.7 KB
├─ 📝 RELEASE.md Markdown 289L · 5.8 KB
├─ 📝 SKILL.md Markdown 355L · 6.4 KB
├─ 📝 TEST-REPORT-v1.0.3.md Markdown 294L · 7.4 KB
└─ 📝 TEST-REPORT.md Markdown 328L · 6.1 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
None (stdlib only) N/A Python standard library No Uses only smtplib, imaplib, email — all from Python stdlib

Security Positives

✓ main.py uses only Python standard library (imaplib, smtplib, email) — no third-party dependencies
✓ No subprocess, os.system, or shell execution in the core skill code
✓ No base64 encoding/decoding or obfuscation
✓ No access to sensitive paths like ~/.ssh, ~/.aws, or .env
✓ No credential harvesting or data exfiltration — credentials are used only for legitimate IMAP/SMTP auth
✓ Network connections are limited to imap.163.com:993 and smtp.163.com:465 (declared in config)
✓ No hidden functionality — all features are documented in SKILL.md
✓ No cron/scheduled tasks or persistence mechanisms
✓ No supply chain risk — no dependencies in requirements.txt or package.json that could introduce vulnerabilities
✓ Config file permissions (0o600) are set during save_config()