Security audit

GoToEmail — 邮箱绑定

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it handles mailbox credentials and can read, send, store configuration, and mark messages read without enough scoping or safety guidance.

Review before installing. Use revocable app passwords or mail-specific authorization codes where possible, avoid primary corporate mailbox passwords unless your organization explicitly approves this workflow, confirm each send/read action, set mark_as_read to false if unread state matters, and verify where saved mailbox credentials can be deleted or revoked.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation instructs operators to pipe email addresses and authorization codes/app passwords directly through stdin as JSON, but provides no warning about sensitive credential handling, storage, logging, or shell history exposure. Even if stdin is safer than command-line arguments, these examples normalize raw credential handling and may lead integrators to leak secrets through logs, transcripts, debugging output, or insecure process orchestration. This is more dangerous here because the skill manages mailbox credentials that grant broad access to private email content and outbound mail sending.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document tells users to use their direct mailbox login password for custom enterprise email accounts, which encourages handling highly sensitive primary credentials instead of safer delegated secrets such as app passwords or service-specific credentials. In the context of an email-binding skill, this is more dangerous because users are being guided to provide secrets to an automation system that may store, transmit, or mishandle them, increasing the risk of account compromise beyond just email access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documented input sets `mark_as_read` to true by default, and the implementation opens the mailbox read-write and applies the `\Seen` flag automatically. This causes a state-changing side effect during what appears to be a read operation, which can alter user mailbox state unexpectedly and may hide unread messages or interfere with workflows that depend on unread status.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.