imap-idle-sneder 安全扫描报告 — 可疑 | ClawSafe

45 /100

imap-idle-sneder

IMAP IDLE email listener with Feishu notifications

Skill performs legitimate IMAP email monitoring but contains hardcoded credentials and undeclared network access to IMAP server and Feishu API.

技能名称imap-idle-sneder

分析耗时43.2s

引擎pi

⚠

谨慎使用

Move all credentials to environment variables or a separate config file. Declare network:WRITE and credential access in SKILL.md. Consider using existing config management instead of hardcoding secrets.

安全发现 5 项

严重性	安全发现	位置
高危	Hardcoded email credentials in source code 凭证窃取 QQ email authorization code stored as string literal PASSWORD = '****' in imap_idle.py line 37. If repo is public or shared, credentials are exposed. `PASSWORD = "****" # QQ邮箱授权码` → Move credentials to environment variables or a separate .env file that is .gitignored	`scripts/imap_idle.py:37`
高危	Hardcoded Feishu API credentials 凭证窃取 Feishu APP_ID, APP_SECRET, and USER_ID stored as string literals in source code (lines 127-129), exposing integration credentials. `FEISHU_APP_ID = "******"` → Load from environment variables: os.environ.get('FEISHU_APP_ID')	`scripts/imap_idle.py:127`
中危	Undeclared network access 文档欺骗 SKILL.md declares 'NONE' permissions but the script makes HTTP requests to open.feishu.cn and connects to imap.qq.com:993. Network access is critical to functionality but not documented. `No network permissions declared` → Update SKILL.md to declare network:WRITE for IMAP and Feishu API access	`SKILL.md:1`
中危	Email content sent to third-party service 数据外泄 Full email body (up to 500 chars), subject, sender name and email are forwarded to Feishu API. This data exfiltration is mentioned in docs but credential theft aspect is concerning. `body = email_info.get('body', '')[:200]...` → Document what data is sent externally. Consider if all email fields need to be transmitted.	`scripts/imap_idle.py:180`
低危	Dependencies without version pinning 供应链 imap-tools and beautifulsoup4 used without version constraints. Could lead to unexpected behavior if a new version changes behavior. `from imap_tools import MailBox` → Pin versions: imap-tools>=0.45.0, beautifulsoup4>=4.9.0	`scripts/imap_idle.py:26`

资源类型	声明权限	推断权限	状态	证据
网络访问	`NONE`	`WRITE`	✗ 越权	scripts/imap_idle.py:136,198
文件系统	`NONE`	`WRITE`	✗ 越权	scripts/imap_idle.py:52-53 writes to workspace and log files
环境变量	`NONE`	`READ`	✗ 越权	Credentials should be env-based but are hardcoded

3 项发现

🔗

中危外部 URL 外部 URL

https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal

scripts/imap_idle.py:136

🔗

中危外部 URL 外部 URL

https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id

scripts/imap_idle.py:198

📧

提示邮箱邮箱地址

[email protected]

scripts/imap_idle.py:36

目录结构

2 文件 · 18.4 KB · 485 行

Python 1f · 407L Markdown 1f · 78L

├─ ▾ 📁 scripts

│ └─ 🐍 imap_idle.py Python 407L · 16.4 KB

└─ 📝 SKILL.md Markdown 78L · 1.9 KB

依赖分析 2 项

包名	版本	来源	已知漏洞	备注
`imap-tools`	`*`	pip	否	Version not pinned
`beautifulsoup4`	`*`	pip	否	Version not pinned, used for HTML parsing

安全亮点

✓ Script functionality is legitimate - email notification service

✓ No reverse shell, C2 communication, or obvious malicious code

✓ No base64 encoding or obfuscation detected

✓ No attempts to access ~/.ssh, ~/.aws, or other credential paths

✓ Uses standard libraries (imaplib, urllib) rather than suspicious tools