Security audit

Email Triager

Security checks for vulnerabilities and agentic risk

Overview

This email triage skill largely matches its stated purpose, but it handles sensitive email content while pointing the agent to an external context-pack site without clear user control or privacy boundaries.

Review this skill before installing if you plan to use it on confidential inbox material. Use it only with emails you intentionally provide, redact credentials and regulated data, review all drafts before sending, and avoid using the external context packs unless you explicitly trust that remote source.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README prominently describes sorting inboxes, extracting action items, and drafting replies, but provides no warning that emails may contain sensitive personal, legal, financial, or corporate information. Because the skill operates on potentially confidential communications at scale, the lack of privacy and data-handling guidance increases the risk that users will submit sensitive content without understanding exposure, retention, or appropriate redaction practices.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The usage examples are broad, natural-language phrases like 'Triage these emails' and 'Draft a reply to this email', which are plausible in ordinary conversation and may cause the skill to activate unintentionally. In a skill that processes inbox content and drafts responses, accidental triggering can expose sensitive email data to the skill or cause unintended processing of user communications.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The instruction "When asked to triage, sort, or process emails" uses generic verbs like "sort" and "process" without defining specific trigger phrases or exclusion conditions. This ambiguity increases the chance of unintended invocation during ordinary conversations about email handling.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill explicitly directs the agent to pair email handling with external context packs hosted at a URL, which expands behavior from local email triage into unbounded external retrieval. That creates prompt-injection, data exposure, and unreviewed-instruction risks, especially if email contents or sensitive business context are used while consulting remote material.

Static analysis

No suspicious patterns detected.