邮件雷达 MailRadar

• Outcome: Review
• Latest audit: Aug 26, 2026 · 5:34 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a real Feishu mail dashboard tool, but it creates persistent full-access automation and stores sensitive email-derived data locally with limited safeguards.

Review this carefully before installing. Use it only if you are comfortable granting it access to your Feishu mailbox through lark-cli, storing email-derived data as local plaintext files, sending summaries and an HTML attachment to the configured Feishu open_id, and creating a daily full-access WorkBuddy automation. Prefer running with --no-push first, avoid install.py unless you want the recurring automation, and delete generated JSON/HTML files when no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def lark(args, timeout=120):
    cmd = "lark-cli " + " ".join(shlex.quote(a) for a in args)
    r = subprocess.run([BASH_EXE, "-lc", cmd], capture_output=True, text=True, cwd=WS, timeout=timeout)
    if r.returncode != 0:
        raise RuntimeError("lark-cli failed [%s]: %s" % (" ".join(args[:3]), r.stderr.strip()[:300]))
    return r.stdout

• Confidence: 87% confidence
• Finding: The helper builds a shell command string and executes it via `bash -lc`, which introduces a command-invocation boundary even though arguments are individually quoted. This becomes dangerous because high-entropy data such as message content, filters, card JSON, markdown, file paths, and environment-driven values may be passed through this wrapper to `lark-cli`, increasing the chance of shell parsing mistakes, option confusion, or unsafe future modifications becoming command injection.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares only tools like Read/Write/Bash, but the documented behavior also relies on environment variables, filesystem access, and shell execution to pull mail, write config/data files, and run automation-related commands. This under-declaration weakens user consent and review because the skill can access local state and persist sensitive email-derived artifacts beyond what a user may expect from the metadata alone.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented primarily as a mail-to-dashboard generator, but the documentation reveals additional high-sensitivity behaviors: collecting personal identifiers, writing persistent config, modifying the local WorkBuddy database, registering recurring automation, and exporting multiple intermediate email-content datasets. That mismatch is dangerous because users may authorize it for a simple reporting task without realizing it also alters local automation state and stores large amounts of potentially sensitive mailbox data on disk.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The installer directly writes a new scheduled automation into WorkBuddy's local SQLite database, which changes persistent application behavior beyond simple configuration generation. Because it creates an automatic task with fullAccess permissions and a free-form prompt, it can silently establish recurring execution that the user may not fully understand or explicitly authorize, increasing the risk of unintended data processing or persistence.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code derives owner_user_id by querying unrelated existing automations and reusing the most common owner, falling back to a hard-coded UUID if none is found. This can register the new automation under the wrong identity, causing privilege confusion, misattribution, or execution in another user's context without verified authorization.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests like '做每日邮件汇总' or '邮件工作清单', which can cause accidental invocation. In this skill's context, unintended activation is more risky because it can read recent mailbox content, generate local artifacts, and potentially push summaries to Feishu or install automation if the user proceeds without realizing the skill was selected.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The usage section describes activation conditions in a way that lacks clear boundaries, increasing the chance that the skill is selected for generic mail-summary requests. Because this skill handles sensitive communications and can set up recurring jobs, accidental activation can expose mailbox data or create persistent side effects beyond the user's immediate intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script writes a derived JSON file containing email thread metadata and content-adjacent fields such as subject, participants, progress, todos, and fresh summaries. In the context of mailbox aggregation and automated sharing, this can expose sensitive business or personal information if the file is stored insecurely, retained too long, or consumed by downstream tools without clear data-handling controls.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code writes pulled email bodies, snippets, metadata, and derived task details to multiple local JSON files in the working directory without any access control, encryption, minimization, or user warning. In a mailbox-processing skill, this is sensitive business correspondence, so local persistence materially increases exposure to other local users, backups, sync tools, or later accidental reuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill packages email-derived summaries, deadlines, and an attached HTML workboard and sends them to Feishu automatically, but there is no explicit privacy notice, confirmation, recipient verification, or content-scoping safeguard. Because this workflow handles recent mailbox contents, silent transmission to a chat platform can leak confidential business communications or personal data to the wrong account or broader downstream audience.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script writes a consolidated JSON file containing email-derived content, including message summaries, fresh body text, participants, deadlines, and thread metadata, to local disk. In a mail-processing skill, that creates a real privacy and data-retention risk because sensitive business or personal email content may persist unencrypted, be reused by other components, or be exposed to other local users/processes without the user being clearly informed.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code loads and processes multiple local JSON sources containing full email bodies and message details, then extracts progress, todos, deadlines, sender/recipient data, and business classifications from them. That is expected for the skill’s functionality, but it still constitutes access to sensitive communications data, and without explicit disclosure, consent, or scope limitation it is a genuine privacy/security weakness rather than a false positive.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes a new file containing email metadata and content excerpts, including senders, recipients, CC lists, subjects, todos, and cleaned message bodies. In a mail-processing skill, this is functionally expected, but it still creates a secondary plaintext data store of sensitive communications without any visible consent, minimization, retention control, or access restriction, which increases privacy and data-leak risk if the workspace or generated artifact is exposed.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def lark(args, timeout=120):
    cmd = "lark-cli " + " ".join(shlex.quote(a) for a in args)
    r = subprocess.run([BASH_EXE, "-lc", cmd], capture_output=True, text=True, cwd=WS, timeout=timeout)
    if r.returncode != 0:
        raise RuntimeError("lark-cli failed [%s]: %s" % (" ".join(args[:3]), r.stderr.strip()[:300]))
    return r.stdout

• Confidence: 91% confidence
• Finding: This wrapper sends constructed content to a shell-backed command invocation and is later used for outbound messaging, including interactive card JSON and markdown generated from email-derived content. Even with quoting, routing untrusted content through `bash -lc` is a fragile boundary: malformed payloads, shell metacharacter edge cases, or future changes can turn mailbox-controlled content into command or option injection, and the skill context amplifies risk because it processes external email data at scale.

Static analysis

No suspicious patterns detected.