Email Checker by EntzAI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:07 AM UTC
• Version: 1.1.1

Overview

The skill does what it claims, but it needs Review because it reads and changes mailbox state on a schedule and has unsafe AppleScript and LLM handling that could expose email or cause unintended actions.

Install only if you are comfortable with a scheduled tool reading your Apple Mail inbox, sending email content to your chosen LLM/report destination, and changing unread status. Prefer a dedicated bot mailbox, local-only LLM mode, no Full Disk Access, no auto cron until reviewed, and manual review of every generated reply before sending.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: setup.sh:141

Finding

Sensitive email content and API credentials may be transmitted to arbitrary or insecure LLM endpoints

Content

View full analysis

Remediation

View remediation

other

Error

• Location: scripts/email/checker.py:369

Finding

Indirect prompt injection through untrusted email content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/email/send_reply.py:42

Finding

AppleScript injection through interpolated recipient and subject values

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.sh:308

Finding

LLM API key stored in plaintext without enforced restrictive permissions

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: setup.sh:376

Finding

Full Disk Access guidance exceeds the minimum privileges required

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/email/checker.py:217

Finding

Broad subject matching may disclose unrelated email threads to the LLM

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/email/checker.py:638

Finding

All unread messages are marked read even when report delivery fails

Content

View full analysis

0 then repeat with msg in unreadMessages set read status of msg to true end repeat ``` ### Technical Analysis `send_email_report()` returns a Boolean indicating delivery success, but `main()` ignores that result. It calls `mark_emails_as_read()` regardless of whether Mail.app rejected the outgoing message, the AppleScript timed out, or another error occurred. The marking operation does not target only messages included in the report. It queries and modifies every message that is unread at execution time, including messages that may have arrived after collection began. This creates a non-transactional processing flow in which the visible mailbox state is changed even though the reporting objective was not achieved. ### Attack Path 1. The checker reads unread messages and generates a report. 2. Report sending fails because of connectivity, Mail.app state, invalid recipient configuration, or an induced timeout. 3. The failed function returns `False`. 4. The caller ignores the failure and marks every currently unread inbox message as read. 5. The user receives no report and may no longer notice the affected messages as unread. ### Impact Assessment The vulnerability can cause: - Loss of unread-status notifications for important messages. - Silent interruption of the expected reporting workflow. - Accidental modification of messages not included in the generated report. - Operational and availability impact, including missed urgent communication. It does not delete email ...[truncated 130 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill claims chat-based management via Telegram or WhatsApp, but the visible setup instead emphasizes cron installation and Apple Mail automation, with no declared trigger/permission model for those powerful behaviors. Hidden persistence via scheduled execution and OS-level Mail control materially increases risk because the skill can repeatedly process mailbox contents or act on the user's behalf after initial installation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims chat-based management via Telegram or WhatsApp, but the visible setup instead emphasizes cron installation and Apple Mail automation, with no declared trigger/permission model for those powerful behaviors. Hidden persistence via scheduled execution and OS-level Mail control materially increases risk because the skill can repeatedly process mailbox contents or act on the user's behalf after initial installation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims chat-based management via Telegram or WhatsApp, but the visible setup instead emphasizes cron installation and Apple Mail automation, with no declared trigger/permission model for those powerful behaviors. Hidden persistence via scheduled execution and OS-level Mail control materially increases risk because the skill can repeatedly process mailbox contents or act on the user's behalf after initial installation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims chat-based management via Telegram or WhatsApp, but the visible setup instead emphasizes cron installation and Apple Mail automation, with no declared trigger/permission model for those powerful behaviors. Hidden persistence via scheduled execution and OS-level Mail control materially increases risk because the skill can repeatedly process mailbox contents or act on the user's behalf after initial installation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill claims chat-based management via Telegram or WhatsApp, but the visible setup instead emphasizes cron installation and Apple Mail automation, with no declared trigger/permission model for those powerful behaviors. Hidden persistence via scheduled execution and OS-level Mail control materially increases risk because the skill can repeatedly process mailbox contents or act on the user's behalf after initial installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code sends email bodies and thread history to the configured LLM service to generate replies, with no explicit consent, warning, redaction, or data-minimization controls visible here. In inbox-processing context, this can expose sensitive personal, legal, financial, or corporate communications to third-party or local model services and may violate privacy expectations or policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill silently marks all unread inbox emails as read after sending the report, which is a materially impactful side effect not implied by a simple checker/reporting workflow. This can cause users to miss messages, interfere with triage rules, and destroy the unread-state signal relied on for security or business operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly states the tool fetches unread emails, sends a report, and marks messages as read, but it does not clearly warn users that private email content may be processed, summarized, transmitted, and that mailbox state will be modified automatically. In this context, the lack of informed-consent messaging increases the risk of accidental exposure of sensitive communications and unintended inbox changes, especially when paired with optional remote LLM use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 140)May include surrounding context.

Cron Schedule

Default: every hour. Change by editing crontab (crontab -e):

text

# Every hour (default)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README documents a workflow where remote Telegram/WhatsApp instructions can trigger outbound email replies, but it does not prominently warn about the risk of mis-triggered, spoofed, or over-broad commands causing unintended email transmission. Because email sending is an externally visible action with reputational and data-loss consequences, documenting remote-control behavior without strong safety caveats is security-significant.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises capabilities that imply filesystem, shell, network, environment, and Mail automation access, but it does not declare an explicit tool scope or permissions model. That makes the skill harder to review safely and can enable overbroad execution in an agent environment, especially because it interacts with local mail data and external LLM providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description omits a clear privacy warning that the skill reads mailbox contents, drafts replies, and may send that data to external LLM providers or messaging platforms. For an email-processing skill, this omission is dangerous because users may expose sensitive personal or corporate data without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The installation and setup section does not clearly warn that setup auto-discovers Mail accounts, writes persistent configuration, and installs a crontab for recurring execution. These side effects affect privacy and system persistence, so failing to disclose them reduces informed consent and may surprise users with ongoing background processing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description advertises broad autonomous behavior like scoring priority, drafting replies, and sending reports on a schedule without stating clear trigger boundaries, approval gates, or scope limits. In an email-handling skill, vague invocation language can lead to over-broad execution, unintended processing of sensitive messages, or actions occurring without sufficiently explicit user expectation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/email/checker.py (reported line 91)May include surrounding context.

python

"""Get unread emails from Inbox using AppleScript (includes content)."""
    script_path = SCRIPT_DIR / "get_unread_emails.scpt"

    result = subprocess.run(
        ['osascript', str(script_path), MAIL_ACCOUNT_ID],
        capture_output=True, text=True
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

This code builds AppleScript source by interpolating email-derived subject text and MAIL_ACCOUNT_ID directly into an osascript -e command. Although quotes in the subject are escaped, AppleScript source injection is still a concern because untrusted content is embedded into executable script text, and malformed inputs can alter script behavior or cause unintended Mail automation.

Content

Scanner excerpt · scripts/email/checker.py (reported line 238)May include surrounding context.

python

'''

    try:
        result = subprocess.run(
            ['osascript', '-e', applescript],
            capture_output=True, text=True,
            timeout=30

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/email/checker.py (reported line 278)May include surrounding context.

python

# ─────────────────────────────────────────────────────────────────────────────
# call_llm  (was call_lm_studio in v2, call_ollama in v1)
# ─────────────────────────────────────────────────────────────────────────────
def call_llm(prompt, model=None, timeout=None):
    """
    Send a prompt to the configured LLM and return generated text.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill embeds prior thread content and current email bodies into LLM prompts and also includes message previews/drafts in emailed reports, creating broad plaintext exposure of potentially sensitive data. Because email commonly contains secrets, personal data, and business context, this context makes the exposure significantly more dangerous than in a generic summarization tool.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

This AppleScript is dynamically assembled with MAIL_ACCOUNT_ID embedded in the script body and then executed. If configuration can be modified by an attacker or another local process, this creates an injection path into AppleScript-driven Mail actions.

Content

Scanner excerpt · scripts/email/checker.py (reported line 449)May include surrounding context.

python

end tell'''

    try:
        result = subprocess.run(
            ['osascript', '-e', script],
            capture_output=True, text=True,
            timeout=30

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest promises management from Telegram or WhatsApp and says the skill drafts AI replies, implying some workflow for user interaction around those drafts. In this implementation, the observable output path is an email report sent via Apple Mail, with no Telegram or WhatsApp handling present in the code shown.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Executing do shell script "cat {report_file}" inside AppleScript is unnecessary for the stated purpose and introduces shell-command injection risk through a path value embedded in executable script text. Because the path originates from runtime/environment-controlled filesystem locations, this expands the attack surface beyond simple email reporting.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The report-sending AppleScript interpolates subject, REPORT_RECIPIENT, and especially report_file into executable AppleScript that runs do shell script "cat ...". This creates command/script injection risk if config or file paths contain unsafe characters, and it combines Mail automation with shell execution.

Content

Scanner excerpt · scripts/email/checker.py (reported line 592)May include surrounding context.

python

end tell'''

    try:
        result = subprocess.run(
            ['osascript', '-e', applescript],
            capture_output=True, text=True,
            timeout=30

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Automatically changing unread messages to read without confirmation is a risky hidden action in an email assistant. In this context, unread state is operationally meaningful, so silently altering it can conceal important or suspicious messages and reduce user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The reply body is written to a predictable workspace file on disk before sending, which creates local data persistence for potentially sensitive email content. On a multi-user system, shared workspace, backup target, or compromised host, drafts may be recoverable after sending and could expose confidential information.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

The script builds AppleScript by directly interpolating untrusted --subject and --to values into quoted AppleScript string literals, then executes it via osascript. An attacker who can influence those fields can break out of the string and inject arbitrary AppleScript commands, which may lead to unauthorized email actions or local command execution through AppleScript features such as do shell script.

Content

Scanner excerpt · scripts/email/send_reply.py (reported line 57)May include surrounding context.

python

end tell'''

    try:
        result = subprocess.run(
            ['osascript', '-e', applescript],
            capture_output=True, text=True,
            timeout=30