Security audit

Email Verification

Security checks across malware telemetry and agentic risk

Overview

This is a coherent email-verification skill that sends user-supplied email data to BounceBan as advertised, but users should treat bulk lists, webhook payloads, and export links as sensitive.

Install only if you are comfortable sending the relevant email addresses or domains to BounceBan. For bulk lists, confirm you have permission and policy approval, avoid regulated or highly sensitive datasets unless approved, use trusted HTTPS webhook endpoints, and treat any CSV download_url as a temporary secret that should not be pasted into shared chats, logs, or tickets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The README encourages broad, natural-language invocations such as "clean this email list" and "verify jane@acme.com" without stating scope limits, confirmation requirements, or privacy guardrails. In an agent setting, this can lead to the skill being triggered on sensitive user-provided datasets and sending emails to a third-party API more readily than the user may realize.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explains setup and usage but does not clearly warn that submitted email addresses and the API key are transmitted to BounceBan, an external third-party service. This omission can cause unintentional disclosure of personal or business contact data and raises privacy, compliance, and data-handling risks, especially for bulk verification workflows.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly states that the export endpoint returns a public download link for bulk verification results, but it does not warn users that the link may expose potentially sensitive email-list data to anyone who obtains it. In this skill context, the exported data can include large customer or prospect email datasets, so treating the link as ordinary output increases the risk of accidental sharing, logging, or reuse in insecure channels.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs sending email addresses or domains to a third-party API but does not warn about privacy, data-sharing, consent, or handling of personal data. Email addresses are often personal data, so users or agents may transmit sensitive contact lists externally without understanding retention, jurisdiction, or compliance implications.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation states that bulk export returns a public download link, but it does not clearly warn users that anyone possessing that URL can access sensitive verification results during the validity window. Because bulk verification data can contain personal email addresses and deliverability metadata, omission of this warning can lead to accidental exposure through logs, chat transcripts, browser history, ticketing systems, or link sharing.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation instructs users to send email addresses and optional webhook URLs to a third-party API but does not warn about privacy, consent, retention, or cross-border data-sharing implications. Because email addresses are personal data in many jurisdictions and webhook URLs may expose internal endpoints or secrets, this omission can lead agents or operators to transmit sensitive data without appropriate review or safeguards.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The webhook documentation encourages sending verification results to arbitrary external HTTP endpoints but does not warn users that the payload contains potentially sensitive email intelligence and account usage data. Without explicit guidance to require HTTPS, authenticate webhook requests, and avoid untrusted destinations, users may expose verified email addresses, verification outcomes, credit balances, and task metadata to interception, misdelivery, or third-party collection.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.