Inbox Triage Bot

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:01 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed email triage guide, but users should handle its mailbox, calendar, OAuth, optional AI, and cron usage carefully.

Install only if you are comfortable granting the configured backend access to your inbox and calendar. Review the linked project before running npm install, keep OAuth or app-password credentials scoped and private, avoid optional AI classification unless you accept the data flow, and only add the cron job if you want recurring unattended triage with local digest files.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Warning

• Location: SKILL.md:59

Finding

Persistent Scheduled Execution Through Cron

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–64
Vulnerability Type: T06: System Persistence
Risk Level: Medium

Vulnerable Code:

bash

## Cron

```bash
# Daily at 7 AM
0 7 * * * cd /path/to/inbox-triage-bot && EMAIL_BACKEND=himalaya npm run demo >> ~/inbox-triage.md 2>&1

text

### Technical Analysis

The Skill instructs the user to configure a cron entry that executes `npm run demo` every day. This creates cross-session persistence and causes the project and its dependencies to run automatically without renewed user approval.

Persistent scheduling is not necessary for the declared core functionality of performing email triage on demand. Because the command operates from a mutable project directory and does not verify the integrity of the application or its dependencies before each run, subsequent modification of project files or installed npm packages would affect every scheduled execution.

The scheduled process also appends email-triage output and errors to the predictable `~/inbox-triage.md` file. Since the Skill processes email and potentially calendar information, that digest may contain sensitive personal or business data. The instructions do not specify restrictive file permissions, retention controls, integrity verification, or a removal procedure for the scheduled task.

The documentation alone does not install the cron entry automatically; exploitation requires the user to follow the provided scheduling instruction.

### Attack Path

1. The user installs the email-triage project and follows the cron configuration shown in `SKILL.md`.
2. The cron service begins invoking `npm run demo` daily under the user's account.
3. The scheduled process accesses the user's configured mailbox and potentially calendar information through the documented backends.
4. If the project directory or installed dependencies are later modified or compromised, the altered code 
...[truncated 834 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the cron configuration from the default setup and keep email triage explicitly user-initiated.
• If recurring execution is an essential optional feature, require clear, informed opt-in and explain the resulting persistent access to email and calendar data.
• Provide commands to inspect and remove the cron entry.
• Run the scheduled task under a dedicated, least-privileged account with access only to the mailbox, calendar, directories, and files required for triage.
• Pin dependencies with a reviewed lockfile and perform integrity verification before deployment.
• Avoid executing directly from a mutable development directory; use a controlled, versioned installation.
• Store reports in a dedicated directory with restrictive permissions, such as mode 0600, and define retention and secure-deletion policies.
• Avoid mixing sensitive report content with unrestricted diagnostic output.
• Document credential scope and recommend restricted OAuth scopes or application-specific credentials rather than broadly privileged account credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Requires OAuth credentials:

bash

cp .env.example .env  # edit with OAuth creds
npm run google:oauth:init
npm run demo

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly fetches inbox contents, classifies emails, and pulls calendar events, but it does not prominently warn users that it will access and process highly sensitive mailbox and scheduling data. This creates a real privacy and consent risk because users may run the skill without understanding the scope of data exposure to local tooling, third-party APIs, or AI classification components.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.