local-mail-digest

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 0.1.0

Overview

This email digest skill is not clearly malicious, but it needs Review because its local-only privacy promise conflicts with optional paths that can send email-derived data to arbitrary network endpoints.

Install only if you are comfortable with the optional network features and can ensure they are used safely. Avoid remote LLM endpoints unless you intend to send email content there, and use webhook delivery only to trusted destinations because subjects, senders, projects, and deadlines may leave the machine. The default local report path is much safer than enabling LLM or webhook options.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: digest.py:289

Finding

Arbitrary LLM Endpoint Can Receive Private Email Content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: host_adapter.py:15

Finding

Unrestricted Webhook URL Enables Email Metadata Disclosure and SSRF

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: digest.py:283

Finding

Untrusted Email Content Can Manipulate LLM-Generated Classification Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as primarily local processing, but it also supports external webhook notifications and other network access without declaring those capabilities in permissions. In the context of email summarization, this creates a real exfiltration risk because processed content may leave the machine despite user expectations and absent policy visibility.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as primarily local processing, but it also supports external webhook notifications and other network access without declaring those capabilities in permissions. In the context of email summarization, this creates a real exfiltration risk because processed content may leave the machine despite user expectations and absent policy visibility.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The header comments and description assert that data stays on the computer, but the code includes multiple outbound network paths such as LLM calls, webhook pushes, and SMTP delivery. This discrepancy is dangerous because users may enable features under a false privacy assumption and unintentionally disclose mailbox contents or summaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The natural-language assurance that data never leaves the computer conflicts with code paths that can transmit email content or summaries externally. This is dangerous because the mismatch masks real exfiltration behavior in a highly sensitive context: processing users' mailboxes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code comments claim the skill only performs local retrieval and structuring, but the implementation also sends data outward. Misleading scope statements in a privacy-sensitive email tool are security-relevant because they can cause unsafe deployment decisions and user consent based on false assumptions.

Content

No source excerpt is available for this finding.

Tainted flow: 'req' from open (line 528, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow
• Confidence: 97% confidence

Finding

llm_enhance sends email metadata and up to 1500 characters of each message body to a user-supplied HTTP endpoint via urllib.request.urlopen. In the context of a skill advertised as local and privacy-preserving, this creates a real exfiltration path for sensitive mailbox content, especially if the endpoint is remote or controlled by an attacker.

Content

Scanner excerpt · digest.py (reported line 323)May include surrounding context.

python

endpoint, data=json.dumps(payload).encode("utf-8"),
        headers={"Content-Type": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=180) as r:
            resp = json.loads(r.read().decode("utf-8"))
        content = resp["choices"][0]["message"]["content"]
        result = _extract_json(content)

Tainted flow: 'req' from open (line 528, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow
• Confidence: 95% confidence

Finding

push_webhook transmits a digest text derived from email subjects and extracted todos to an arbitrary webhook URL. Even though it sends a summary rather than full raw messages, this still leaks potentially sensitive business or personal content to external services and is inconsistent with the skill's stated local-only behavior.

Content

Scanner excerpt · digest.py (reported line 532)May include surrounding context.

python

url, data=json.dumps(payload).encode("utf-8"),
        headers={"Content-Type": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=10) as r:
            resp = r.read().decode("utf-8")
        print(f"[推送] Webhook({wh_type}) 响应: {resp[:80]}")
        return True

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inline documentation emphasizes local-only execution and that data does not leave the computer, yet the adapter can post summaries to remote webhook endpoints. In a mail-processing skill, that discrepancy is especially dangerous because email metadata and extracted deadlines/projects are often sensitive business or personal information, and users may not scrutinize optional flags when the documentation strongly promises local-only behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill markets itself as '数据不出电脑' and zero-config local processing, but it includes functionality to transmit mail-derived summaries to arbitrary webhook URLs. This creates a security/privacy mismatch: users may reasonably believe processed email content never leaves the machine, while high-priority subjects, senders, projects, and deadlines can in fact be sent to external services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises capabilities that imply file access, shell execution, and network use, but it does not declare any explicit tool scope or permissions in the manifest. In an agent ecosystem, missing scope declarations weaken least-privilege controls and can cause hosts or users to underestimate what the skill may access or invoke.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The statement '数据不出电脑' conflicts with the documented webhook and SMTP push functionality. Security-sensitive documentation contradictions are dangerous because they can mislead users and integrators about data handling guarantees, increasing the chance of accidental leakage of private email content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The optional LLM path transmits message content to an OpenAI-compatible endpoint without an in-band warning that email data is being sent off-process and potentially off-device. In a mailbox-processing skill, that omission can lead to accidental disclosure of sensitive content to remote inference services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file contains outbound push features (SMTP and webhook) that go beyond simple local summarization and output generation. In a mail-digest skill, these functions materially expand the attack and privacy surface by creating new channels through which derived message content can leave the device.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Webhook and SMTP push are not necessary to perform local mail digestion, yet they allow summarized mailbox content to be transmitted externally. Unnecessary outbound capability increases privacy risk and broadens misuse potential if a host agent or user configuration provides attacker-controlled destinations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · host_adapter.py (reported line 52)May include surrounding context.

python

cmd += ["--md", a.md]
    if a.llm:
        cmd += ["--llm", a.llm, "--model", a.model]
    subprocess.run(cmd, check=True)
    print(f"[桥接] 已生成 {a.out} / {a.json}")

    if a.webhook:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

When --webhook is used, the program sends a condensed email summary containing sender, subject, project, and deadlines without any user-facing warning, preview, or confirmation that data is leaving the local machine. Given the skill's privacy-focused positioning, this lack of disclosure materially increases the risk of accidental exfiltration of sensitive email-derived information.

Content

No source excerpt is available for this finding.