Agentic Email Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.9

Overview

This skill locally drafts sales email sequences and renders user-selected PDF/Markdown/PNG artifacts without evidence of network callbacks, credential access, persistence, or email sending.

Install only if you want a local drafting and document-rendering helper for sales/lifecycle email artifacts. Review the pinned Python dependencies, especially the optional PNG preview stack, and avoid providing sensitive prospect or client data unless you are comfortable storing it in generated local Markdown/PDF/PNG outputs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims domain-specific email-sequence generation, but the analysis indicates the implemented behavior is largely generic document rendering plus PNG export. This mismatch is dangerous because users may grant trust or provide sensitive sales/customer data under false assumptions about what the skill does, and undeclared output transformations increase the attack surface for data handling and abuse.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

| Execution | Runs local Python entry points: `scripts/render_email.py` and `scripts/render_pdf.py`. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

| Execution | Runs local Python entry points: `scripts/render_email.py` and `scripts/render_pdf.py`. |

Known Vulnerable Dependency: pillow==12.2.0 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file pins Pillow to version 12.2.0, and the supplied finding indicates multiple published advisories affecting that exact version. Because this skill can optionally generate PNG preview artifacts, it may invoke Pillow on image/PDF-derived content, which increases the chance that a vulnerable code path could be reached and lead to denial of service or, for some advisories, command execution on affected platforms.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · README.md (reported line 127)May include surrounding context.

md

|---|---|
| Email delivery | Does not send email, contact prospects, call mail-provider APIs, add tracking pixels, or approve outreach. |
| Credentials | Does not read mail credentials, API keys, browser sessions, or CRM tokens. |
| System changes | Does not create persistence, escalate privileges, run background services, or perform destructive file operations. |

## Network Boundary

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

|---|---|
| Email delivery | Does not send email, contact prospects, call mail-provider APIs, add tracking pixels, or approve outreach. |
| Credentials | Does not read mail credentials, API keys, browser sessions, or CRM tokens. |
| System changes | Does not create persistence, escalate privileges, run background services, or perform destructive file operations. |

## Network Boundary

Static analysis

No suspicious patterns detected.