Security audit
Security checks across malware telemetry and agentic risk
This looks like a legitimate email-training skill, but it deserves review because it handles real mailbox data, persists sensitive artifacts locally, and can expose an unauthenticated local/LAN UI while offering optional mailbox-changing tools.
Install only if you want an agent to work with real email-training data. Use demo mode first if unsure, do not expose serve-ui.py to untrusted networks, stop the server when done, review ~/.config/email-swipe for retained data, and require explicit approval before any label/folder creation or mail-platform rule changes.
def run_cmd(cmd, capture=True):
"""Run a command and return output or None if fails."""
try:
result = subprocess.run(
cmd,
shell=True,
capture_output=capture,def run_cmd(cmd, timeout=30):
"""Run a command and return output."""
try:
result = subprocess.run(
cmd,
shell=True,
capture_output=True,63/63 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution