Security audit
Security checks for vulnerabilities and agentic risk
This is a simple email-help skill that works on pasted or described email content and does not request mailbox access, execution, persistence, or sending authority.
Before using it, redact secrets, credentials, personal data, and confidential business details from pasted emails when possible, and manually review any generated reply or task list before acting on it.
The skill explicitly asks users to paste email text, which may contain sensitive personal, financial, legal, or business information, but it provides no privacy warning or data-handling caution. In this context, that omission materially raises risk because users may share confidential email contents, client data, or internal tasks without understanding the sensitivity implications.
The invocation examples use very generic phrases such as asking to 'help process this email' or 'look at today's emails,' which can overlap with normal conversation and increase the chance of accidental or unintended activation. In a productivity/email context, this is more dangerous because activation could lead users to paste or summarize sensitive business communications without a deliberate decision boundary.
No suspicious patterns detected.
