Security audit
Security checks across malware telemetry and agentic risk
This email-digest skill is mostly purpose-aligned, but its privacy claims understate optional network paths that can send email-derived content off the computer.
Review this before installing if your mailbox contains sensitive personal, business, legal, or financial information. The default file-processing path appears local, but do not use --llm unless the endpoint is one you control, and do not use --webhook unless you are comfortable sending sender names, subjects, deadlines, and summary content to that service. The publisher should correct the local-only privacy claims or enforce a true local-only mode.
endpoint, data=json.dumps(payload).encode("utf-8"),
headers={"Content-Type": "application/json"})
try:
with urllib.request.urlopen(req, timeout=180) as r:
resp = json.loads(r.read().decode("utf-8"))
content = resp["choices"][0]["message"]["content"]
result = _extract_json(content)url, data=json.dumps(payload).encode("utf-8"),
headers={"Content-Type": "application/json"})
try:
with urllib.request.urlopen(req, timeout=10) as r:
resp = r.read().decode("utf-8")
print(f"[推送] Webhook({wh_type}) 响应: {resp[:80]}")
return TrueVirusTotal findings are pending for this skill version.
No suspicious patterns detected.