Security audit
Security checks for vulnerabilities and agentic risk
This email automation skill is purpose-aligned but asks for sensitive mailbox access and documents automatic mailbox changes without enough scoping, privacy guidance, or confirmation safeguards.
Review this skill carefully before installing. It may need access to your mailbox credentials or tokens and is designed to archive, label, and draft email. Use least-privilege OAuth where possible, avoid broad IMAP passwords if an app-specific password or scoped token is available, disable AUTO_ARCHIVE until you have reviewed behavior, and do not rely on the included test mode as a no-write dry run.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
description: Path to Gmail API credentials JSON
required: false
OUTLOOK_ACCESS_TOKEN:
description: Outlook/Microsoft Graph access token
required: false
IMAP_SERVER:
description: IMAP server address
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
description: Path to Gmail API credentials JSON
required: false
OUTLOOK_ACCESS_TOKEN:
description: Outlook/Microsoft Graph access token
required: false
IMAP_SERVER:
description: IMAP server address
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export EMAIL_ADDRESS="your@email.com"
# Gmail API (if using Gmail)
export GMAIL_CREDENTIALS_FILE="/path/to/credentials.json"
# Outlook API (if using Outlook)
export OUTLOOK_ACCESS_TOKEN="your_access_token"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export EMAIL_ADDRESS="your@email.com"
# Gmail API (if using Gmail)
export GMAIL_CREDENTIALS_FILE="/path/to/credentials.json"
# Outlook API (if using Outlook)
export OUTLOOK_ACCESS_TOKEN="your_access_token"
The skill advertises automation features such as auto-archive and inbox cleanup without clearly warning that it can modify the user's mailbox. Users may invoke it expecting analysis only, but the documented behavior includes state-changing operations that can move or hide messages and affect retention of important emails.
The example trigger phrase is broad and resembles normal user speech, which increases the chance the skill activates unintentionally during routine conversation. Because this skill can process, categorize, archive, and draft actions against a live mailbox, accidental invocation could cause unintended mailbox modifications or exposure of email-derived content.
The skill requests high-sensitivity mailbox credentials and tokens, including Gmail credentials, Outlook access tokens, and IMAP passwords, but provides no privacy or data-handling warning. This is dangerous because users are encouraged to grant broad access to email contents and account actions without being told how secrets are stored, scoped, or protected.
The file write target is derived from EMAIL_AUTOMATION_DATA_DIR, an environment variable, and is written without validation or restriction. If an attacker can influence the environment when this script runs, they can redirect writes to unintended filesystem locations, causing clobbering of files accessible to the process or persistence in attacker-chosen paths.
"""Save history of processed emails"""
ensure_data_dir()
history_file = DATA_DIR / 'processed.json'
with open(history_file, 'w') as f:
json.dump(history, f, indent=2)
def simulate_fetch_emails():
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
},
{
'id': 'email_005',
'from': 'auto-confirm@amazon.com',
'subject': 'Your order has shipped',
'snippet': 'Great news! Your order #12345 has been shipped...',
'date': '2026-03-06T15:20:00Z',
The program explicitly claims that test mode makes no changes, but it still calls process_emails(), which writes processed history to disk. This is a state-changing behavior that can mislead users, contaminate test runs, and undermine safe validation workflows, especially in automation contexts where dry-run semantics are relied upon.
The file is predominantly written in English, but the support section switches to Chinese without asking the user for a language preference or documenting a locale-specific reason. This can violate language/locale policy expectations where user-facing content should not force a language without opt-in.
No suspicious patterns detected.