Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only email API skill whose sensitive capabilities are broadly disclosed and aligned with its stated purpose.
Before installing, understand that this skill can let an agent read and send email, access attachment contents, and create persistent webhooks that forward email metadata and snippets. Use a narrowly scoped API key, confirm recipients before sending, and only configure webhook URLs you control and trust.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /event-hooks/{id}
The skill enables high-risk actions—reading inbox contents, sending email, handling attachments, and configuring webhooks—but the description does not warn users that sensitive communications and metadata may be accessed or transmitted. In an agent context, lack of explicit consent and privacy warnings can lead to unintended disclosure of email content and misuse of outbound messaging capabilities.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -H "Authorization: Bearer $XOBNI_KEY" \
"https://api.xobni.ai/api/v1/emails?status=received&limit=20"
The webhook section states that payloads include email metadata and a 200-character snippet, but it does not warn that this data will be transmitted to third-party endpoints chosen by the operator. That omission increases the chance that users expose sensitive sender, subject, or partial body content to systems that are less trusted or improperly secured.
Creating a webhook sends email event data to an arbitrary external URL, which can become a data-exfiltration path if misconfigured or pointed at an untrusted endpoint. In this skill, that risk is elevated because the webhook payload includes email metadata and snippets, yet the example does not emphasize the sensitivity of what is being forwarded.
Set up real-time notifications when emails arrive or are sent:
curl -X POST -H "Authorization: Bearer $XOBNI_KEY" \
-H "Content-Type: application/json" \
"https://api.xobni.ai/api/v1/event-hooks" \
-d '{
This webhook example forwards email event information to a user-specified external endpoint, creating a real possibility of sensitive metadata leakage or unintended onward sharing. Because the skill processes real email and explicitly includes snippets in webhook payloads, the context makes this more dangerous than a generic webhook example.
curl -X POST -H "Authorization: Bearer $XOBNI_KEY" \
-H "Content-Type: application/json" \
"https://api.xobni.ai/api/v1/event-hooks" \
-d '{
"url": "https://your-endpoint.com/webhook",
"events": ["email.received"],
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Xobni.ai REST API Reference
Base URL: `https://api.xobni.ai/api/v1`
All requests require `Authorization: Bearer YOUR_API_KEY` header.
This markdown file documents a POST /emails/send operation that transmits message bodies, recipient addresses, and base64-encoded attachments, but it does not include any warning about privacy, data handling, or the impact of sending user content through the API. Under the markdown-specific SQP-2 criteria, behaviors affecting user data or privacy should be disclosed to users.
The Create Webhook section allows forwarding email events to a user-specified URL, and later sections show payloads containing sender/recipient addresses, subject lines, and body snippets. The documentation does not warn that configuring a webhook causes ongoing transmission of potentially sensitive mailbox data to an external endpoint, which is a privacy- and integrity-relevant behavior.
No suspicious patterns detected.