Security audit

email-query-summary

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to summarize email, but it handles sensitive mailbox credentials and message bodies with broad auto-triggering and weak safeguards.

Install only if you are comfortable giving the skill read access to the configured mailboxes. Protect accounts.json like a password file, avoid syncing or committing it, and use the skill only for explicit mailbox-summary requests until the trigger scope and content minimization are tightened.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs the agent to execute a Python script that performs live IMAP access, which is a network-capable action, yet no explicit permission declaration is shown. In an agent ecosystem, hidden or undeclared network access reduces user and platform visibility into sensitive data flows and can enable mailbox access without appropriate consent or sandbox policy review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The description frames the skill as producing a summary, but the documented behavior includes extracting body snippets, attachment filenames, and raw email details. This mismatch is dangerous because users may authorize a narrow summarization task while the skill processes and exposes substantially more sensitive mailbox content than reasonably expected.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The setup instructs users to place IMAP authorization codes in a plaintext local `accounts.json` file and does not warn that this file contains sensitive credentials requiring strict protection. If the skill directory is shared, synced, logged, backed up insecurely, or committed to version control, those tokens could be exposed and used to access mailbox contents.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill mandates real-time retrieval of mailbox content but does not require a clear notice that private email data will be accessed and processed. Because email often contains highly sensitive personal or business information, lack of explicit disclosure and consent increases the risk of unauthorized or unexpected privacy exposure.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The manifest describes very broad trigger scenarios such as checking mail, mail reports, time-range mail, and send/receive statistics, which can overlap with common user requests and cause the agent to invoke this skill too aggressively. Because the skill has network access and retrieves live mailbox contents, overbroad routing increases the chance of unnecessary access to sensitive email data beyond user intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script connects to configured IMAP accounts, retrieves message metadata plus up to 3000 characters of message body, and prints all results as JSON without any built-in minimization, consent gate, or output redaction. In a skill context, this can expose sensitive mailbox contents to downstream consumers, logs, or users who invoked a broad query, making privacy and data-exposure risk real even if the feature is intentional.

Static analysis

No suspicious patterns detected.