qqmail

clawhub:qqmail

View source

100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

100/100

LOW 3

Findings (3)

LOW

Unrestricted email or messaging access EXFIL_012

exfiltration L40

Detects CLI tools granting unrestricted send/read access to email or messaging

py send --to "recipient@example.com" --subject

FIX

Restrict email and messaging API access to user-initiated actions. Prevent automated sending that could exfiltrate data via email body or attachments.

FP?

Likely FP if the skill is an email client or messaging tool whose documented purpose is to send messages on behalf of the user.

LOW

Unrestricted email or messaging access EXFIL_012

exfiltration L45

Detects CLI tools granting unrestricted send/read access to email or messaging

py send --to "recipient@example.com" --subject

FIX

Restrict email and messaging API access to user-initiated actions. Prevent automated sending that could exfiltrate data via email body or attachments.

FP?

Likely FP if the skill is an email client or messaging tool whose documented purpose is to send messages on behalf of the user.

LOW

pip install arbitrary package EXTDL_009

external-download L76

Detects pip install of arbitrary packages that modify the host environment

pip install ne

FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.