AI Email Agent

• Outcome: Review
• Latest audit: Jun 20, 2026 · 7:55 PM UTC
• Version: 1.0.0

Overview

This appears to be a real email automation tool, but it needs review because it can read customer mail, send live replies, share message data with external services, and expose ticket data through an unauthenticated dashboard.

Install only with a test mailbox first. Treat `run` as capable of sending real replies to customers, configure least-privilege IMAP/SMTP accounts, review what customer data may be sent to the LLM and webhooks, avoid exposing the dashboard beyond localhost or add authentication, and pin/review dependencies before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares required binaries and sensitive environment variables and clearly instructs users to run Python commands that will access external services, but it does not declare corresponding permissions/capabilities in a transparent way. This can mislead users and reviewers about the skill's actual access to environment secrets, local files, and network resources, increasing the risk of unintended mailbox access or outbound communications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The top-level description frames the skill as an email auto-reply agent, but the documented behavior extends into web dashboard hosting, persistent storage of customer communications, webhook-based notifications, spam/blacklist maintenance, and operational tooling. This broader behavior materially changes the security and privacy profile because it processes and stores customer data and exposes additional interfaces that users may not expect from the brief description.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes a fully automated customer-email workflow that can read live mailbox contents and send outbound SMTP replies, but it does not prominently warn users about the risks of processing sensitive customer data or accidentally messaging real recipients. In an LLM-driven email agent, this omission increases the chance of unsafe deployment, privacy violations, and unintended business communications.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The run instructions explicitly enable continuous operation with IMAP/SMTP but do not warn that this mode can automatically send replies to real customers. Because the skill is specifically designed for ecommerce customer support, users may reasonably execute the command as documented and unintentionally trigger unauthorized or incorrect outbound communications at scale.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The quick-start section tells users to run the agent loop but does not prominently warn that doing so will automatically connect to mailboxes, read incoming mail, and send outbound replies. In an autonomous email agent, that omission is dangerous because a user may trigger real-world communications and customer-data processing without fully understanding the consequences.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The classifier sends full email content, sender identity, and subject to an external LLM service, which creates a real privacy and data-governance risk if users have not explicitly consented or if the deployment does not clearly disclose third-party processing. In an email-support context, messages commonly contain PII, order data, addresses, and sensitive complaints, so transmitting them off-system can violate least-privilege and regulatory expectations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends customer identifiers and email content to an external LLM in `_llm_generate_reply`, including sender name, email address, subject, and part of the message body. In a customer-support context this commonly includes personal data, order information, and complaint details, so transmitting it without minimization, consent, or clear disclosure creates a real privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The translation/localization path sends reply content to the LLM in `_llm_polish`. Even though this is outbound text, it can still contain customer-related information such as names, ticket numbers, product details, complaint summaries, and order references, causing unnecessary exposure of customer data to a third-party service.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The prompt includes full sender name, email address, subject, and body, then asks the model to extract entities and summarize the content, which materially increases exposure of personal and transactional data to the LLM provider. In an e-commerce support mailbox, this data can include order numbers, contact details, refund information, and potentially sensitive complaint details, making over-sharing especially risky.

Ssd 3

Medium

• Confidence: 86% confidence
• Finding: Storing raw LLM output for debugging is risky because the model response may echo or transform sensitive email content, including customer identifiers and order details. If logs, traces, or returned objects are later persisted or exposed to operators, this increases the data-retention and secondary-disclosure surface beyond the original processing purpose.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.30.0
pyyaml>=6.0
python-dotenv>=1.0.0
requests>=2.31.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce breaking or vulnerable releases into the email agent's runtime.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.30.0
pyyaml>=6.0
python-dotenv>=1.0.0
requests>=2.31.0

• Confidence: 98% confidence
• Finding: PyYAML is unpinned, so installs may pull in different versions, including versions affected by known unsafe deserialization issues if dependency resolution or environment drift occurs. In an LLM-driven email automation system that may parse configuration or templates, this increases supply-chain and unsafe parsing risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.30.0
pyyaml>=6.0
python-dotenv>=1.0.0
requests>=2.31.0

• Confidence: 90% confidence
• Finding: Using an unpinned python-dotenv version permits non-reproducible installs and may introduce vulnerable or incompatible releases unexpectedly. This is primarily a dependency hygiene issue, but it can matter if the agent writes or manages environment files in production workflows.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.30.0
pyyaml>=6.0
python-dotenv>=1.0.0
requests>=2.31.0

• Confidence: 97% confidence
• Finding: Requests is also unpinned, allowing installations to drift to versions with known security issues or behavioral changes. Because this skill is an email automation agent likely making outbound HTTP/API calls, dependency drift in a networking library is more operationally and security-relevant than in a purely local tool.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The file allows installation of PyYAML versions associated with multiple advisories, including unsafe deserialization and input validation flaws. If this email agent consumes YAML configuration, prompts, workflow definitions, or integrations from untrusted sources, vulnerable PyYAML usage could lead to code execution or other serious compromise.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: The dependency has a reported advisory involving symlink following during set_key operations, which can enable arbitrary file overwrite in specific usage patterns. This is only exploitable if the application uses python-dotenv to modify .env files and does so in a filesystem context influenced by an attacker.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The requirements permit requests versions with multiple advisories, including issues involving credential leakage and TLS/request verification behavior. For an AI email agent that likely calls external APIs and services, flaws in the primary HTTP client can expose secrets, enable SSRF-adjacent abuse, or weaken transport security.

Static analysis

No suspicious patterns detected.