Security audit

Email Helper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local email-template helper with some documentation and feature mismatches, but no evidence of exfiltration, destructive behavior, or hidden high-impact actions.

Install only if you are comfortable with a simple local email-drafting helper. Treat generated drafts as templates, avoid putting sensitive email content into any optional saved-record workflow unless you understand where sent_emails.json is stored, and expect limited language support despite broader claims.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The example trigger phrases are very broad, natural-language requests such as asking to write leave, business, or thank-you emails. In systems that route skills based on user utterances, this can cause unintended invocation of the skill for ordinary conversation, which may lead to incorrect routing, privacy exposure of user content, or unexpected skill behavior.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrases are very broad and map to common, everyday language such as writing or replying to emails. This can cause the skill to activate in situations outside the author's intended scope, increasing the chance of unintended behavior, misrouting user requests, or unnecessary access to file-backed template functionality.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The module docstring states '支持：中文/英文/日文', implying Japanese is supported. In practice, language handling only distinguishes English from a default Chinese path, and there are no Japanese templates or Japanese-specific routing in the code.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The top-level documentation lists '回复建议' as a feature, but the module contains template generation, polishing, subject suggestion, and stats only. There is no function or main-path behavior that analyzes an incoming email and produces reply suggestions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code persists sent email records to a local JSON file without any consent flow, disclosure, retention policy, or access controls. Because email content can contain personal, financial, employment, or business-sensitive data, silent local storage creates a privacy and data-exposure risk if the host environment is shared, backed up, or later accessed by other processes/users.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: Although the module header says it supports Chinese, English, and Japanese, the runtime language detection only selects English for a small set of English keywords and otherwise defaults to Chinese. Several paths such as work reports and meeting invitations generate Chinese templates regardless of user preference, which can impose a locale without explicit user opt-in.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The default response claims '其他功能：- 邮件润色 - 主题建议 - 发送记录统计'. However, while helper functions for polishing and subject suggestion exist, main() never routes user queries to them, so those capabilities are not actually available through the skill's interface.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The skill title, description, and all example invocations are presented only in Chinese, which suggests a language-specific interaction model. There is no stated user choice or justification for restricting the skill to Chinese, which may conflict with language/locale policy expectations.

Static analysis

No suspicious patterns detected.