myskil

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent email-monitoring purpose, but it needs review because it would run an unaudited background mailbox monitor, persist email data locally, and automatically install software or dependencies.

Install only if you are comfortable granting a local background process ongoing access to a logged-in mailbox and allowing it to save message screenshots, attachments, and extracted email data on the Desktop. Before use, require the publisher to include the referenced scripts, remove or justify ExecutionPolicy Bypass, document exact storage locations and retention, pin dependencies, and ask for explicit approval before installing software or starting persistent monitoring.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:148

Finding

PowerShell Commands Disable Execution-Policy Enforcement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 148-153
Vulnerability Type: PowerShell security-control bypass
Risk Level: Medium

Vulnerable snippet:

markdown

## Start

```powershell
powershell -ExecutionPolicy Bypass -File scripts/webmail_monitor_cli.ps1 start

text

The same `-ExecutionPolicy Bypass` pattern is also prescribed for status, logs, bootstrap, doctor, and stop operations at lines 22, 26-27, 54-55, 206, 212-215, and 225.

### Technical Analysis

The documented invocation explicitly sets the PowerShell execution policy to `Bypass` for the new PowerShell process. This suppresses execution-policy warnings and policy-based script blocking within that process.

Execution policy is not a complete security boundary, but disabling it removes a defense-in-depth control that could otherwise prevent or warn about running untrusted scripts. The risk is amplified because `scripts/webmail_monitor_cli.ps1` is not present in the audited package. Consequently, the actual script content, provenance checks, and safeguards cannot be verified.

The supplied package cannot currently execute the command because the referenced script is absent. Exploitation therefore requires the script path to be populated or replaced before invocation.

### Attack Path

1. A user or agent follows the command prescribed by `SKILL.md`.
2. An attacker, compromised distribution source, or unsafe installation process places a malicious file at `scripts/webmail_monitor_cli.ps1`.
3. PowerShell starts with `-ExecutionPolicy Bypass`.
4. The substituted script executes without execution-policy prompts or blocking.
5. The script obtains the same filesystem, network, mailbox-session, and process privileges as the invoking user.

### Impact Assessment

Successful exploitation permits arbitrary code execution in the invoking user's security context. Potential scope includes access to the user's files, Desktop artifacts, bro
...[truncated 308 chars]

Remediation

View remediation

Remediation Suggestions

• Remove -ExecutionPolicy Bypass from all documented commands.
• Include the referenced PowerShell and Python scripts in the reviewed package.
• Digitally sign PowerShell scripts and use the host's configured execution policy.
• Verify the script's expected hash or signature before execution.
• Restrict write access to the skill and scripts directories so untrusted users cannot replace the launcher.
• Resolve the script path from a trusted, canonical skill root rather than the caller's uncontrolled working directory.
• Run the monitor as an unprivileged user and avoid administrative execution.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:158

Finding

Automatic Installation of Unspecified and Unpinned Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 158-163
Vulnerability Type: Uncontrolled dependency and host-software installation
Risk Level: Medium

Vulnerable snippet:

markdown

After the first start:

- Finish mailbox login in the opened Edge window or the relevant seeded mail
  tab
- Keep that Edge profile for future runs
- The CLI auto-runs a bootstrap step that installs missing Python dependencies
  and refreshes the local `webmail-monitor` shim
- The bootstrap step also detects missing Python or Microsoft Edge and attempts
  to install them automatically with `winget`

The bootstrap responsibilities are further described at lines 188-199 as installing required Python packages, installing Python or Edge when absent, and recreating the local command shim.

Technical Analysis

The skill instructs its missing bootstrap component to install Python dependencies and host software automatically. SKILL.md does not identify required package names, exact versions, package indexes, hashes, signatures, or trusted publisher identifiers. The implementation that would perform these installations is absent from the project, so repository selection, command construction, package validation, and shim replacement behavior cannot be audited.

Installing Python packages generally executes package-controlled installation or runtime code. Resolving packages without locked versions and trusted sources exposes the workflow to dependency confusion, typosquatting, compromised package releases, and unexpected future-version changes. Automatic host-software installation and command-shim replacement further expand the affected supply chain.

No malicious dependency or remote payload was observed in the available project. The finding concerns the unsafe and unverifiable installation design documented by the skill.

Attack Path

1. The user or agent starts the monitor.
2. The documented bootstrap proc ...[truncated 1257 chars]

Remediation

View remediation

Remediation Suggestions

• Include all bootstrap and monitor scripts in the package so their behavior can be reviewed.
• Maintain a lock file containing exact Python package names and versions.
• Require hashes for downloaded Python distributions and dependencies, such as with pip --require-hashes.
• Use only explicitly configured HTTPS indexes and trusted publishers.
• Pin winget package identifiers, sources, and versions where supported, and verify publisher signatures.
• Separate dependency installation from normal monitor startup and require informed user approval before changing host software.
• Do not silently replace the command shim; verify its destination, ownership, and expected content.
• Run installation and monitoring with least privilege.
• Fail closed when signatures, hashes, package sources, or publisher identities cannot be validated.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

Move the rest into scripts.

## Fast return rule

When the user asks to start or enable monitoring, do not keep the current chat
turn open waiting for mailbox login, message opening, attachment processing, or

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md

- Avoid machine-specific hardcoded paths in `SKILL.md`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the system to download email attachments to the Desktop, capture full message screenshots, and write message content into a local Excel workbook, but it does not prominently warn about this data persistence at the point of use. That creates a privacy and data-handling risk because sensitive email content and attachments may be stored locally without sufficiently explicit operator awareness or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that first-run bootstrap may automatically install Python, Microsoft Edge, and dependencies via winget, but this behavior is not surfaced as a prominent warning in the main description. Silent or unexpected software installation expands trust boundaries and can surprise operators with host modifications they did not knowingly approve.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.