ShellMail - Email Built for AI Agents

• Analyzed: May 11, 2026, 4:38 AM
• Findings: 1
• Version: 1.0.12
• Hash: 430543af401f8ac2dc7df4e274417f0d72ce9af1ffc414370468d2f6d113487c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The shellmail skill provides a legitimate interface for AI agents to interact with the ShellMail API for managing emails and extracting OTPs. The bash script (scripts/shellmail.sh) is a well-structured wrapper using curl and safe JSON construction via jq or python3. The agent instructions in SKILL.md include explicit security warnings and require the agent to obtain user confirmation before persisting the sensitive SHELLMAIL_TOKEN using the gateway configuration, showing alignment with its stated purpose without hidden malicious behavior.