E-commerce Gmail Customer Service

• Outcome: Review
• Latest audit: Jul 26, 2026 · 11:15 AM UTC
• Version: 1.1.0

Overview

This skill uses sensitive Gmail and merchant-service access, but the artifacts disclose the access, default to drafts, require user consent for learning, and include meaningful safety gates.

Install only for a dedicated support mailbox and understand that full Gmail authorization can read, label, draft, and potentially send mail if later enabled. Keep the default draft-only mode until testing is complete, avoid sharing status output, review the editable runtime prompt/workflow/memory files, and replace the default persona with business-appropriate traits before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares broad operational capabilities through its documented commands and workflow, including shell execution, file reads/writes, environment-variable use, and network access, but does not present an explicit permission model. That gap weakens reviewability and consent because operators may not realize the full privilege footprint required to process email, edit runtime prompts, crawl storefronts, and manage local state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The stated purpose focuses on safe Gmail customer-service triage, but the documented behavior extends into storefront crawling, runtime prompt/workflow editing, memory merging, and installation/configuration management. This mismatch increases security risk because users may authorize the skill for customer-service drafting while overlooking that it can alter its own operating instructions, persist learned behavior, and fetch external web content.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The persona includes age, gender, and especially appearance/body-shape attributes that are unnecessary for an e-commerce customer-service skill and can bias model behavior toward inappropriate or unprofessional outputs. Even though later guardrails say not to disclose or use these traits, embedding them in the default persona increases the chance of accidental leakage, flirtatious tone drift, or discriminatory behavior in customer interactions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The onboarding instructs operators to create a customer-service persona with sexualized and appearance-based traits that are unrelated to the skill’s function. This can bias responses, create harassment or discrimination risks, and encourage anthropomorphic deception in customer communications without any business or safety justification.

Intent-Code Divergence

Low

• Confidence: 74% confidence
• Finding: The status command claims to show only non-sensitive configuration status, but it includes operational identifiers such as Gmail account, store name, storefront URL, and provider metadata. In shared terminals, logs, support bundles, or CI output, this can disclose tenant-specific information and aid targeting or reconnaissance.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script writes merged data into a persistent per-user memory file without any built-in confirmation, approval gate, or visible notice to the end user. In a customer-service skill, persistent memory can influence future responses and decisions, so unauthorized or overly broad updates could create long-lived privacy, integrity, and compliance issues even if the code is intended for legitimate state management.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_runtime.py:18