Versioned security assessment

Report ID: SA-89EDFDC7

7/23/2026, 7:43:22 AM

atomicmail security assessment v5

Skill Security Certification Report

Audit History

Scanner version 3.0.0 Audit model: codex Latest published report

Skill name: atomicmail
Version: v0.3.14
Maintainer: Atomic Mail
Source: github.com/atomic-mail/atomic-mail-agentic/tree/main/integrations/skill/atomicmail
Coverage: 137 Files scanned · 5,852 Lines analyzed
Policy version: skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are false positives from generated declarations, documentation, relative imports, regular-expression .exec, and a commented eval. Nine intended fetch calls are confirmed as low-risk network behavior, but semantic review found high-risk credential disclosure, unrestricted endpoints, arbitrary attachment reads, and unsafe autonomous email handling. Static review was capped at 400/864 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

137 Files scanned · 5,852 Lines analyzed

13 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Commit and path bound
Artifact

Content and tree hashes bound
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 39 evidence locations

Filesystem access

May read or write local files.

Observed in 43 evidence locations

Env variables

May read values from the process environment.

Observed in 20 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (9)

Low

lib/esm/lib/agent/auth/agent-auth-http.js:5

Fetch API call

const res = await fetch(`${authUrl}/api/v1/challenge`, {

This is a real outbound HTTP request to the configured Atomic Mail or JMAP service. It is expected functionality but remains security-relevant network access.

Low

lib/esm/lib/agent/auth/agent-auth-http.js:26

Fetch API call

const res = await fetch(`${authUrl}/api/v1/session`, {

This outbound authentication request sends a challenge, API key, or bearer token to the configured auth service. It is intended behavior with real credential exposure.

Low

lib/esm/lib/agent/auth/agent-auth-http.js:54

Fetch API call

const res = await fetch(`${authUrl}/api/v1/capability`, {

This outbound authentication request sends a challenge, API key, or bearer token to the configured auth service. It is intended behavior with real credential exposure.

Low

lib/esm/lib/agent/jmap/agent-jmap-blob-upload.js:38

Fetch API call

const res = await fetch(uploadUrlExpanded, {

This outbound request uploads selected attachment bytes with a capability JWT to the JMAP upload URL. The behavior is declared, but it exposes local data and credentials to a network endpoint.

Low

lib/esm/lib/agent/jmap/agent-jmap.js:180

Fetch API call

const res = await fetch(`${base}/.well-known/jmap`, {

This is a real outbound HTTP request to the configured Atomic Mail or JMAP service. It is expected functionality but remains security-relevant network access.

Low

lib/esm/lib/agent/jmap/agent-jmap.js:345

Fetch API call

const res = await fetch(jmapPostUrl, {

This outbound request sends a caller-provided JMAP batch with a capability JWT. It is core email functionality but can read, modify, or send mailbox data.

Low

lib/esm/lib/network/auth-client.js:68

Fetch API call

const res = await fetch(`${this.baseUrl}/api/v1/capability`, {

This outbound authentication request sends a challenge, API key, or bearer token to the configured auth service. It is intended behavior with real credential exposure.

Low

lib/esm/lib/network/auth-client.js:80

Fetch API call

const res = await fetch(`${this.baseUrl}/api/v1/challenge`, {

This is a real outbound HTTP request to the configured Atomic Mail or JMAP service. It is expected functionality but remains security-relevant network access.

Low

lib/esm/lib/network/auth-client.js:100

Fetch API call

const res = await fetch(`${this.baseUrl}/api/v1/session`, {

This outbound authentication request sends a challenge, API key, or bearer token to the configured auth service. It is intended behavior with real credential exposure.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High

lib/esm/lib/agent/session/agent-session.js:232-237 lib/esm/skill/cli.js:114-118

Registration Exposes the New API Key in Agent Output

New-account registration returns apiKey from AgentSession and the CLI serializes the full result to stdout. Agent transcripts and execution logs can therefore retain the credential.

The returned object explicitly includes apiKey, and the CLI writes that object to standard output without redaction.

RISK-002 High

lib/esm/skill/cli.js:87-90 lib/esm/skill/cli.js:122-128 lib/esm/lib/agent/auth/agent-auth-http.js:24-33

Custom Endpoints Can Receive Atomic Mail Credentials

The agent-facing CLI accepts unrestricted auth and API URLs. It sends API keys or bearer tokens to those destinations without HTTPS enforcement, origin checks, or operator confirmation.

The URL comes directly from CLI or environment configuration, and exchangeSession posts the supplied API key to that URL.

RISK-003 High

lib/esm/skill/cli.js:147-172 lib/esm/lib/agent/jmap/agent-jmap-blob-upload.js:65-96

Attachment Paths Permit Arbitrary Local File Upload

The CLI accepts absolute or relative attachment paths, reads each file without an allowlisted root, and uploads its bytes. A manipulated agent could disclose local secrets.

The implementation resolves any supplied path, reads it with readFile, and sends the bytes to the session upload URL.

RISK-004 High

SKILL.md:168-173 lib/shared/help/topics/cron.md:54-58

Scheduled Inbox Turns Lack Untrusted-Content Boundaries

The skill recommends autonomous agent turns that fetch and summarize email but does not tell the agent to treat message content as untrusted. Malicious email can attempt tool-use prompt injection.

The documented recurring workflow explicitly invokes a full agent on inbox data, while its prompt provides no instruction hierarchy or prohibition on acting on email instructions.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
High
New-account registration prints the API key to standard output.

Persist the API key only in the mode-0600 credential file. Return a redacted registration result containing the inbox and account identifier.
FIX-002
High
Custom endpoints can receive API keys and bearer tokens.

Require HTTPS, validate allowed origins, reject cross-origin JMAP session URLs, and require explicit operator approval before using non-default endpoints.
FIX-003
High
Attachment paths can read and upload any accessible local file.

Restrict attachments to an approved directory and require operator confirmation showing the resolved path, destination, recipient, and file size.
FIX-004
High
Scheduled inbox prompts do not isolate instructions contained in email.

Mark email content as untrusted data. Keep scheduled jobs read-only and require operator approval before replies, sends, uploads, or other side effects.
FIX-005
Medium
Static review capped

Manually review the omitted 464 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: 89edfdc710d0846129dcee6a929477b04f08052c
Content hash: 2ce4a1b88ac8fbb51d53167fd0aefcf48a2b2e421329eee6bc88950375e07176
Tree hash: 4595cfdaef08735f321e6a025737632614922893c414804f053a021e69692175
Skill path: skills/atomic-mail/atomicmail
Audit payload hash: 8fedaef168d5f87ae7fbf99264dcfb02

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active