mail-imap-sync

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:38 PM UTC
• Version:
  1.0.3

Overview

This skill does what it claims by syncing configured IMAP email into local Markdown files, but the saved mail and IMAP password should be treated as sensitive.

Install only if you are comfortable storing mailbox contents as local Markdown files. Use an app-specific IMAP password, keep config.json and the emails directory private, consider a virtual environment or container, and delete saved mail/state when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly syncs mailbox contents and stores parsed emails locally as Markdown, but it does not clearly warn users about the privacy and data-handling implications of doing so. This can lead to accidental ingestion and persistence of sensitive content such as credentials, personal data, financial records, or internal communications into local storage or downstream AI pipelines.

VirusTotal

67/67 vendors flagged this skill as clean.