Security audit

email-query-summary

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real email-query helper, but it deserves Review because it can access configured mailboxes too broadly and stores mail authorization codes in plaintext.

Install only if you intentionally want this skill to read configured email accounts. Before use, narrow when agents may invoke it, require explicit confirmation for mailbox access, store authorization codes outside the skill directory or lock down accounts.json, keep that file out of version control and backups, and prefer revocable app-specific mail credentials.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Overbroad instructions hijack agent routing and force mailbox access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SETUP.md:49
Finding: Reusable mailbox authorization codes are stored in a plaintext project file
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 代码与描述在“实时按时间范围从已配置邮箱拉取邮件数据、需要 accounts.json 配置”这一点上基本一致，但核心产出不一致。描述强调这是“邮箱查询总结技能”，应输出重要邮件、往来统计、待办跟进等分析性结果；而代码仅执行 IMAP 检索并返回邮件明细 JSON，没有任何重要性判断、统计聚合、待办提取或总结逻辑。因此其实际行为更像“邮件抓取/导出工具”，而不是所声明的“查询总结技能”，属于实质性描述与行为不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger rule is extremely broad, including any conversation mentioning words like '邮件', '邮箱', or '收件箱', and it instructs the agent to immediately invoke the skill. This can cause accidental mailbox access in loosely related discussions, leading to unnecessary retrieval of sensitive email content without clear user intent.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
**路径约定**：`<SKILL_ROOT>` 指本 skill 所在目录（即本文件 `SKILL.md` 的父目录）。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup instructions require users to place live IMAP authorization codes into a local plaintext accounts.json file, but provide no warning about securing the file, limiting file permissions, excluding it from version control, or using a secret store. Because this skill is designed to access real email accounts, compromise of that file would directly expose mailbox access and could lead to unauthorized reading of sensitive communications.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill directs the agent to execute a Python script that connects to email accounts over the network, but the manifest does not declare any explicit tool scope or permissions boundary. In agent platforms, missing scope declarations weaken least-privilege controls and can cause users or orchestrators to approve a skill without realizing it will access remote mail services and local credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill mandates real-time email retrieval but does not clearly require notifying the user that their mailbox contents will be accessed and processed. For a privacy-sensitive resource like email, lack of transparent consent increases the risk of surprise access to confidential communications and attachments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: L121-L123 明确要求“仅简体中文”并禁止英文过渡语，这构成了固定语言输出约束。文件中未提供用户选择语言的机制，也未说明这是特定地区合规或场景必须要求，因此属于语言/locale 策略违例。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest uses broad trigger language such as checking mail, weekly summaries, and time-range queries, and even states the skill must be forcibly used when the scenario matches. That creates overbroad activation for ordinary user requests and can cause unnecessary mailbox access, exposing sensitive email content and metadata when a narrower or consent-based tool selection should apply.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest advertises live IMAP retrieval using configured accounts and credentials but does not prominently warn that mailbox contents, message metadata, and stored credentials will be accessed. In a skill that reads real email, missing disclosure increases the risk of users or orchestrators invoking it without understanding the privacy and credential sensitivity involved.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Argument parsing only recognizes Chinese natural-language period terms such as '今天', '本周', and '最近7天', and all user-facing messages are also fixed in Chinese. This imposes a language/locale constraint without user opt-in or a clearly documented region-specific justification in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script logs into configured email accounts, fetches message bodies and attachment metadata, and prints the collected contents as JSON without any consent gate, data minimization, or warning at runtime. In an agent-skill context, this can expose sensitive mailbox contents to downstream consumers, logs, or unintended users, making privacy and data-exfiltration risk materially real.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill setup instructions force a single language/locale presentation for all users, and no opt-in, alternative language, or region-specific justification is provided in the file. Under the policy, a fixed language without user choice can constitute a natural-language policy violation.
Content: No source excerpt is available for this finding.