Daily Email Summary

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:22 AM UTC
• Version: 1.0.0

Overview

The skill appears to do Gmail email summaries, but it handles private email bodies and OAuth tokens with under-disclosed scope and user-control gaps.

Install only if you are comfortable granting read-only Gmail access and letting the agent process email contents. Before use, confirm the credential and token file locations, prefer limiting the number or query scope of emails summarized, and revoke/delete the OAuth token when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions while its documented behavior clearly relies on environment access, network access to Gmail, and likely local file writes for OAuth token handling. This mismatch undermines informed consent and policy enforcement, because an agent or user may invoke a capability-bearing skill without understanding that it will access credentials, contact external services, and persist auth material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill promises recent-email summaries, but the observed behavior includes unread-email targeting, substantial raw content handling, OAuth flows, and token storage. That is a meaningful expansion of scope involving sensitive personal data and credential persistence, which can expose more inbox content than users expect and create additional secrets on disk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill text explains that it fetches and summarizes emails but does not clearly warn users that private email contents will be accessed and potentially transmitted to an AI system for summarization. For a mailbox-integrated skill, that omission is security-relevant because users may not realize highly sensitive personal, financial, or corporate content is being processed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The invocation instructions direct the agent to use Gmail credentials and execute a helper script, but they do not require an explicit warning or consent flow before accessing the user's inbox and credential material. In agent settings, that increases the chance of silent access to sensitive communications and local secrets without the user's informed approval.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This skill fetches email subjects, senders, snippets, and body content, then prints them as JSON to stdout for agent consumption without any built-in minimization, consent gate, or warning. In an agent skill context, mailbox contents are highly sensitive and may include secrets, personal data, reset links, or business information, so unrestricted output increases the risk of privacy leakage and downstream exfiltration.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

google-auth>=2.25.0
google-auth-oauthlib>=1.2.0
google-auth-httplib2>=0.2.0
google-api-python-client>=2.110.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows future unreviewed versions to be installed. This can introduce supply-chain risk, unexpected breaking changes, or vulnerable releases into the skill at install time, especially because this skill accesses Gmail-related libraries and would likely run with access to sensitive email data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

google-auth>=2.25.0
google-auth-oauthlib>=1.2.0
google-auth-httplib2>=0.2.0
google-api-python-client>=2.110.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows future unreviewed versions to be installed. This can introduce supply-chain risk, unexpected breaking changes, or vulnerable releases into the skill at install time, especially because this skill accesses Gmail-related libraries and would likely run with access to sensitive email data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

google-auth>=2.25.0
google-auth-oauthlib>=1.2.0
google-auth-httplib2>=0.2.0
google-api-python-client>=2.110.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows future unreviewed versions to be installed. This can introduce supply-chain risk, unexpected breaking changes, or vulnerable releases into the skill at install time, especially because this skill accesses Gmail-related libraries and would likely run with access to sensitive email data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

google-auth>=2.25.0
google-auth-oauthlib>=1.2.0
google-auth-httplib2>=0.2.0
google-api-python-client>=2.110.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows future unreviewed versions to be installed. This can introduce supply-chain risk, unexpected breaking changes, or vulnerable releases into the skill at install time, especially because this skill accesses Gmail-related libraries and would likely run with access to sensitive email data.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.