Security checks across malware telemetry and agentic risk
This email skill mostly does what it says, but it needs review because it handles private email, can create recurring chat notifications, and has unsafe or under-scoped defaults around notification targets and attachment downloads.
Install only if you intend to give this skill Resend email access and want email data available to an agent. Before enabling cron, replace the hardcoded Telegram examples with your own destination, verify the configured chat/topic, and know how to remove the cron job. Use a least-privileged Resend key, avoid --yes except in trusted automation, and download attachments only to a controlled folder while treating filenames and contents as untrusted.
]
print(f"Running: {' '.join(cron_cmd)}")
result = subprocess.run(cron_cmd, capture_output=True, text=True)
if result.returncode != 0:
print(f"Error adding cron: {result.stderr}")66/66 vendors flagged this skill as clean.