Bulk Email Address Validation Neverbounce

• Outcome: Review
• Latest audit: Jun 23, 2026 · 9:54 PM UTC
• Version: 1.0.0

Overview

The skill matches its stated email-validation purpose, but it can send contact lists to a paid third-party service without clear activation boundaries or an explicit user consent step.

Install only if you intend agents to validate email lists with NeverBounce through AgentPMT. Before use, confirm the list owner has permission to share those addresses with NeverBounce, avoid submitting unnecessary contact data, and make sure the agent only invokes this skill for explicit bulk email validation requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation keywords include generic terms like "verify" and "emails," which can cause this skill to trigger in unrelated contexts involving ordinary email handling. That increases the chance an agent sends user-provided email lists to a third-party verification service without sufficiently specific user intent or informed consent.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description repeats broad invocation language and lacks clear boundaries for when the skill should or should not be used. In an agentic environment, ambiguous routing guidance can cause unintended use of a remote third-party service on sensitive contact data, creating privacy and workflow integrity risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs agents to submit user email lists to an external verification provider but does not require an explicit user-facing disclosure that the addresses will be transmitted off-platform. Because email lists are often personal or customer data, silent transmission can violate privacy expectations, internal policy, or regulatory obligations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The schema exposes a bulk email verification action that sends up to 1000 email addresses to NeverBounce, but it does not warn users that personally identifiable contact data will be transmitted to a third-party service. This can lead to unintentional privacy, compliance, and data-handling violations, especially when agents process CRM exports, imported contact lists, or regulated customer data without explicit user awareness or consent.

VirusTotal

VirusTotal findings are pending for this skill version.