Sales Email Automation (IMAP/SMTP)

• Outcome: Review
• Latest audit: May 29, 2026 · 9:29 PM UTC
• Version: 1.0.0

Overview

This email skill does useful IMAP/SMTP work, but it also adds under-scoped sales automation that can archive mail, send email data to other services, run local commands, and write CRM records.

Install only after reviewing the non-email automation. Use dedicated mailbox/app passwords and separate API tokens, keep OpenRouter, Discord, OKKI, auto-capture, and cron disabled unless you explicitly need them, restrict local read/write directories, and fix the shell-command construction before using it on real inbound email.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (37)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill exposes powerful capabilities through environment variables, network access, and shell execution but does not declare permissions or scope boundaries in the manifest. This weakens reviewability and least-privilege enforcement, making it easier for a user or host system to authorize a seemingly simple email skill that can actually access broader resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The manifest presents the skill as a generic IMAP/SMTP email tool, but the documented behavior extends into CRM synchronization, local archival, AI-driven content analysis, external knowledge retrieval, auto-drafting, Discord workflow, and real-email integration testing. This mismatch can mislead users and reviewers about the data flows and trust boundaries, increasing the chance that sensitive email content is sent to additional systems without informed approval.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly enables OKKI integration and local mail archiving in addition to basic IMAP/SMTP operations, which materially expands the skill's effective behavior beyond its stated read/send email scope. This creates a hidden data-processing surface where mailbox contents and customer intelligence can be collected, correlated, and retained without clear scope limitation or minimization.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The auto-capture workflow is described as storing email content and attaching matched customer records, which goes well beyond transient mailbox access for reading or sending mail. Persisting and enriching communications increases the blast radius of any compromise, and users may not expect a mail skill to build a local intelligence archive of their correspondence.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The document instructs the email skill user to leave the IMAP/SMTP scope and execute shell commands in another skill's workspace to generate quotations. This creates scope creep and can enable unintended command execution, file access, or cross-skill data handling beyond the advertised email-only capability, especially if downstream inputs like customer identifiers or file paths are not tightly controlled.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill documentation expands scope beyond email transport into OKKI CRM synchronization and Discord review workflows, but this broader functionality is not reflected in the manifest’s stated purpose. Hidden or under-declared integrations are dangerous because they can route sensitive message contents and metadata into third-party systems that operators did not expect to authorize.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The OKKI CRM integration adds customer matching and CRM record creation that are outside the core function of reading and sending email. Because email content often contains sensitive personal, commercial, and contractual data, silently coupling mailbox access to CRM enrichment materially enlarges the data exposure surface.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The Discord review integration introduces an unrelated third-party communications channel into an email-processing skill, creating a path for email-derived content to be copied into chat systems. This increases confidentiality risk, especially if review channels are misconfigured, broadly accessible, or retained outside the organization's email compliance controls.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script materially exceeds the stated IMAP/SMTP read/send scope by automatically archiving full email contents to local storage and enriching them with external CRM data. This creates a confidentiality and data-minimization risk because sensitive mailbox contents are copied to disk and combined with additional customer context without clear user-consented scope boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This code sends sender-derived data to external OKKI/vector-search tooling that is unrelated to basic email transport operations. Even if intended for workflow enrichment, it expands data exposure beyond the advertised email functionality and may disclose personal or business email metadata to additional local systems without adequate notice or isolation.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script constructs shell commands with untrusted email-derived values such as domain and company name and executes them via execSync. An attacker can craft a sender address or display name containing shell metacharacters to trigger command injection, leading to arbitrary local code execution under the account running the skill.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This file defines an intent-classification and auto-reply policy layer, including reply template IDs, escalation behaviors, and auto-draft decisions, which materially expands the skill from simple IMAP/SMTP transport into automated email triage and response handling. That scope expansion is security-relevant because misclassification or hidden automation can cause unauthorized business communications, mishandling of complaints, or inappropriate automated responses using mailbox access the user may not expect.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module introduces a Discord-based human approval and local review queue workflow that is outside the declared IMAP/SMTP-only capability of the skill. Even if intended as an operational safeguard, undocumented side-channel review logic expands the system’s data flows and trust boundaries, which can surprise users and reviewers and create unauthorized handling of email content.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code packages email draft body, subject, sender, intent, and timestamps into a Discord embed and sends it to an external Discord channel. For an IMAP/SMTP skill, this is a clear data exfiltration path to a third-party service not described in the manifest, potentially exposing sensitive or regulated email content to unauthorized systems and users.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Reading a repository-level .env file to obtain a Discord bot token introduces unrelated secret handling into an email skill and increases the chance of cross-component credential exposure. This broadens the blast radius of the skill because it reaches outside its own configuration scope and may access secrets intended for other modules.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements an automated email classification, knowledge-retrieval, reply-generation, and external review workflow, which materially exceeds the manifest's stated IMAP/SMTP mailbox read/send scope. This scope mismatch is dangerous because users granting mailbox access for standard email operations may unknowingly enable downstream processing and sharing of message content, increasing the risk of unauthorized handling of sensitive communications.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code sends email-derived data to Discord for review, which is an external third-party channel unrelated to the stated IMAP/SMTP functionality. This creates a clear data exfiltration/privacy risk because potentially sensitive sender metadata and generated reply context can leave the mailbox environment without user awareness or necessity for core email transport features.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation describes an 'intelligent email reply pipeline' rather than a simple IMAP/SMTP utility, reinforcing that the implemented behavior diverges from the advertised capability. This inconsistency is dangerous because it can conceal higher-risk automation and content processing behind a lower-risk description, undermining informed consent and security review.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The integration test sends email-derived draft content to Discord, which creates an unnecessary data flow from private mailbox content into a third-party messaging platform. For an IMAP/SMTP email skill, this broadens data exposure beyond the stated purpose and can leak sensitive message content, contact details, or commercially confidential information during testing.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This code sends email subject and up to 2000 characters of body content to OpenRouter, a third-party LLM service, for classification. Because this skill handles potentially sensitive email data and the skill description only presents IMAP/SMTP functionality, this is an undisclosed external data exfiltration path that can leak confidential, personal, or regulated information outside the mail provider boundary.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill introduces dependency on an unrelated external AI API and an additional secret (OPENROUTER_API_KEY) beyond the stated purpose of reading and sending email. This expands the attack surface and trust boundary: compromised configuration, misuse of the API key, or unexpected model/vendor behavior could expose message contents or create unauthorized outbound data flows.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements local knowledge-base retrieval against hard-coded user directories and an Obsidian vault, which is materially different from the declared IMAP/SMTP email functionality. A skill whose manifest claims email operations but also accesses unrelated local data creates a stealth data-access surface that could expose sensitive files to the agent or downstream outputs without user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code invokes a local Python script through child_process using a shell-constructed command that includes a query string, introducing unnecessary command-execution capability in a skill that is supposed to handle email. Even if the current paths are fixed, this expands the attack surface substantially and could enable command injection or execution of unintended local code if inputs or referenced files are manipulated.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The module explicitly implements OKKI CRM synchronization for quotations and order/contracts, which exceeds the declared IMAP/SMTP email skill scope. This creates hidden business-action capability that can write external CRM records from an email-oriented skill, increasing the chance of unauthorized data propagation, unexpected side effects, and abuse of granted trust and credentials.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code invokes external OKKI and vector-search Python tooling via paths from environment variables, but those capabilities are not disclosed by the email skill description. Hidden execution of external tools expands the attack surface, may exfiltrate message content to other systems, and undermines the principle of least privilege because operators may grant email access without expecting CRM/search side effects.

VirusTotal

54/54 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: auto-capture.js:88

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: kb-retrieval.js:29

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: okki-sync.js:65

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/smtp-wrapper.js:45

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: auto-capture.js:18

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: integration-test.js:57

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: intent-recognition.js:116

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: reply-generation.js:184

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: reply-generator.js:64

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/imap.js:16

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: test-read.js:8