Security checks across malware telemetry and agentic risk
This skill does what it claims by emailing reports, but unsafe command execution and weak credential handling make it something users should review before installing.
Install only after review or patching. Prefer environment or a secret manager over the plaintext config file, avoid msmtp mode until the shell command is fixed, use app-specific SMTP credentials, and only run it after checking the exact recipient and report contents.
f.write(msg.as_bytes())
cmd = f'cat {temp_file} | msmtp -t {to_addr}'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
return result.returncode == 0### Option 2: Config File
Create `~/.email_reporter.conf`:
```json
{64/64 vendors flagged this skill as clean.