Email Assistant

• Outcome: Review
• Latest audit: Jun 22, 2026 · 5:58 PM UTC
• Version: 1.8.0

Overview

This skill appears to match its email-assistant purpose, but it asks for powerful mailbox access and has several weak or misleading safety controls that users should review before installing.

Install only if you are comfortable granting this skill read/write/send access to your mailbox and storing mail credentials locally. Prefer your own Azure app registration if possible, install keyring support, keep the data directory out of version control, verify any auto-reply rule with dry-run first, and revoke access directly in the provider account portal rather than relying only on the included revoke command.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

system = _plt.system()
    try:
        if system == "Windows":
            os.system(f'start "" "{url}"')
        elif system == "Darwin":
            subprocess.Popen(["open", url])
        else:  # Linux and other Unix-like

• Confidence: 96% confidence
• Finding: The Windows branch uses os.system() with a formatted string containing the authorization URL, which invokes a shell and can enable command injection if attacker-controlled data reaches the URL. In this script, client_id, tenant_id, and scopes are loaded from a local account JSON file, so a maliciously crafted configuration could break out of the quoted argument on Windows and execute arbitrary commands under the user's privileges.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module documentation promises a plaintext fallback for credential and token storage when keyring is unavailable, but the helper functions shown only return None/False and do not actually implement that fallback. This mismatch can cause callers to assume credentials are being persisted securely or at least reliably when they are not, leading to broken auth flows, accidental insecure ad hoc storage elsewhere, or silent loss of secrets.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The helper claims to retrieve credentials securely, but it calls `data_dir.secure_get(...)` even though only `secure_get` was imported. Because `data_dir` is undefined, credential retrieval will raise a runtime error before any authentication occurs, creating a denial-of-service condition for email operations and potentially pushing operators to store or use weaker fallback credential handling elsewhere.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The revocation routine claims to revoke tokens server-side, but the code cannot verify success and unconditionally prints success because of `if result is not None or True`, which is always true. This can leave refresh/access tokens valid at the provider while the user is misled into believing revocation completed, creating a false sense of security after credential compromise or account offboarding.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script advertises --dry-run as only showing what would happen, but _sync_account still calls _update_sync_state even when dry_run is enabled. This mutates persistent state and can suppress or distort later processing, violating operator expectations and making audits or safe previews unreliable.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrase "帮我配置邮箱" initiates a high-privilege setup flow that creates account configs, launches OAuth, and stores credentials, yet the wording is broad and conversational. A user could invoke it without understanding that it will perform sensitive configuration actions, increasing the risk of overbroad consent and unintended credential onboarding.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The setting description says users can add or remove mail accounts by simply saying so, which encourages automatic execution of sensitive account-management actions from vague natural language. Because account changes affect stored credentials and future mail access, this creates a risky consent boundary and can lead to unintended destructive or privacy-impacting actions.

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.