ClawHub
Back to skill

Security audit

ai-gmail-inbox-classifier-auto-archive-with-hourly-telegram

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it automates Gmail triage by labeling and archiving inbox mail and sending Telegram alerts for important messages, with the main risk being the broad automatic mailbox changes.

Before installing, confirm you want an hourly workflow to read your Gmail inbox, classify messages, apply labels, remove processed messages from the inbox, and send Telegram alerts with links for important emails. Test on a limited mailbox or with reversible labels first if missed inbox visibility would be disruptive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The public-facing description emphasizes convenience but does not clearly warn that the workflow will automatically archive every inbox email and send details of 'important' messages to Telegram. This can cause users to enable a workflow without understanding that it changes mailbox state at scale and transmits potentially sensitive metadata/content to a third-party messaging channel.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.