Expanso email-triage

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:56 PM UTC
• Version: 1.0.0

Overview

The skill’s email-triage purpose is coherent, but it exposes sensitive email and calendar/mailbox authority with weak scoping and network controls.

Review before installing. Use only with mailboxes where sending content to OpenAI is acceptable, prefer a local-only backend for sensitive email, bind the MCP server to localhost or add authentication, and avoid enabling calendar creation or archiving unless you can review changes before they are applied.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:24

Finding

Unauthenticated MCP Service Exposed on All Network Interfaces

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-cli.yaml:125

Finding

Email Content Is Passed Directly to the CLI LLM Without Prompt-Injection Controls

Content

View full analysis

"EMAIL ID: " + e.id + "\n" + "FROM: " + e.from + "\n" + "SUBJECT: " + e.subject + "\n" + "BODY: " + e.body.slice(0, 500) + "\n---" ).join("\n\n") root.messages = [ { "role": "system", "content": "You are an expert email triage assistant. Analyze emails and classify each one. For each email, determine: 1. category: urgent, action-required, meeting, fyi, newsletter, or spam 2. priority: 1 (highest) to 5 (lowest) 3. action: what the recipient should do (e.g., 'respond immediately', 'schedule meeting', 'review document', 'archive', 'unsubscribe') 4. calendar_event: if it's a meeting request, extract {title, proposed_date, proposed_time, duration_minutes} Respond with a JSON array matching the email IDs provided." }, { "role": "user", "content": "Classify these emails:\n\n" + $emails_text + "\n\nRespond with JSON array: [{\"id\": \"...\", \"category\": \"...\", \"priority\": N, \"action\": \"...\", \"calendar_event\": null or {...}}]" } ] meta emails = this.emails - openai_chat_completion: api_key: "${OPENAI_API_KEY}" model: gpt-4o-mini ``` ### Technical Analysis Email subjects, sender fields, and body text are attacker-influenced data. The pipeline concatenates those values directly into the model's user message. The system prompt does not explicitly state that instructions appearing inside email data are untrusted and must never be followed. An attacker can therefore place model-directed instructions in an email ...[truncated 2439 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:68

Finding

Email Content Is Passed Directly to the MCP LLM Without Prompt-Injection Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pipeline sends full email contents, including subject, sender, and body, to an external OpenAI chat completion service. Because emails commonly contain sensitive personal, business, or regulated data, forwarding them to a third party without an explicit consent notice, minimization, or redaction control creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This manifest-like YAML file describes the skill as 'Process emails and automatically create calendar events' but does not specify any concrete invocation phrases, scope limits, or exclusion conditions. In a manifest or descriptive file, such broad natural-language capability statements can act as vague triggers and risk unintended activation in common email-handling contexts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comments create a misleading privacy assurance by stating the AI never sees authentication while omitting that full email bodies are transmitted to OpenAI for classification. This can cause users to process sensitive or regulated email content under false assumptions about data exposure, increasing privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The pipeline sends raw email metadata and body text to an external AI service, including sender, subject, and up to 500 characters of each message body, without an explicit in-skill warning or consent mechanism. In an email-triage context this is particularly sensitive because inboxes commonly contain confidential business, legal, HR, financial, or personal data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This manifest file includes the example trigger "Triage my inbox and find any urgent emails," which overlaps with ordinary user speech and does not define clear activation boundaries or exclusions. Because the file does not provide a constrained trigger list or negative examples, the invocation scope is ambiguous for MCP routing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · pipeline-mcp.yaml (reported line 15)May include surrounding context.

yaml

#   → Routes to POST /triage
#
#   # Or call directly
#   curl -X POST http://localhost:8080/triage \
#     -H "Content-Type: application/json" \
#     -d '{"provider": "gmail", "limit": 50}'
#

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes a mailbox-modifying action via the auto_archive input, but the spec does not require an explicit confirmation or warn that enabling it will change mailbox state. In an email-triage context, misclassification or accidental enablement could archive important messages and cause loss of visibility or workflow disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The create_calendar_events option enables automatic writes to the user's calendar, but the skill text does not clearly warn that events may be created without per-event review. In this context, imperfect extraction from emails or maliciously crafted meeting content could create incorrect, unwanted, or disruptive calendar entries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.