Security audit

Email Autopilot

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for email management, but it asks for broad automatic access to highly sensitive inbox and sent-mail content without clear opt-in scope or controls.

Install only if you are comfortable giving the agent broad access to your inbox, sent folder, and email history. Before using it, confirm that mailbox access is opt-in, limited to chosen accounts/folders/time ranges, that automatic briefings and sent-mail tracking can be disabled, and that learned templates, VIP lists, writing-style data, and follow-up state can be reviewed and deleted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase "Check my email" is a common, natural utterance that could be invoked unintentionally in broader conversation or chained workflows, causing the agent to access and summarize sensitive mailbox contents without a sufficiently explicit, scoped action. Because this skill operates on highly sensitive data and can perform inbox-wide reading, broad triggers increase the risk of accidental activation and privacy exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The phrase "automatically every morning as part of morning briefing" authorizes recurring execution without clearly defining consent, scope, or whether the user can disable it per session. Automatic mailbox scanning on a schedule materially increases privacy risk because the agent may process new sensitive content without a fresh user request or contextual confirmation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: "Automatic after every email you send" is an overly broad trigger that continuously monitors sent mail and infers which messages contain questions or requests, expanding processing beyond explicit user-initiated use. Even if the follow-up action later requires approval, the background analysis of all outgoing correspondence creates unnecessary data exposure and could surprise users who did not intend persistent monitoring.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The setup text states that the agent "reads your inbox and sent folder automatically," which grants blanket ongoing access to highly sensitive communications without clear activation boundaries, minimization, or consent controls. In an email skill, unrestricted automatic access is especially dangerous because inboxes often contain credentials, financial records, legal communications, and other confidential data.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The statement that the agent identifies recurring noise senders automatically lacks precise boundaries for when monitoring begins and how broadly mailbox activity is analyzed. While lower risk than auto-send, it still normalizes background behavioral profiling of email patterns and may lead to unexpected classification of legitimate correspondence as noise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.