Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Drin email-sending skill with expected external email delivery behavior, but users should confirm message content and recipients before sending.
Install only if you intend agents to send email through Drin. Before use, confirm the sender domain, recipients, subject, body, and whether the content is appropriate to transmit to an external email provider; avoid secrets or regulated data unless you have explicit authorization and safeguards.
The skill does not warn that email body content, recipient addresses, sender details, and possibly templating data will be transmitted to an external third-party service. Without an explicit disclosure, an agent may send sensitive personal, financial, or authentication-related information off-platform without the user understanding the privacy and compliance implications.
The skill encourages use any time email needs to be delivered, but it does not require the agent to confirm user intent, sensitivity of content, or whether sending data to an external provider is appropriate. This can cause over-activation in contexts involving secrets, personal data, or actions the user did not explicitly authorize, increasing the risk of unintended disclosure through the Drin API.
