Security audit

Email Manager

Security checks across malware telemetry and agentic risk

Overview

This skill locally manages an email JSON file, and its sensitive-data behavior is disclosed and aligned with that purpose.

Install only if you are comfortable storing email contents and drafts as local plaintext JSON. Keep the email directory private, avoid pointing EMAIL_DIR at broad or shared locations, and confirm any future real SMTP/API integration before allowing sends.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The README claims the email store is confined by path validation, but the documented configuration explicitly allows overriding the storage directory via EMAIL_DIR. If the implementation follows this documentation without strict canonicalization and workspace-bound checks, a user or calling process could point the skill at arbitrary filesystem locations, causing unintended read/write access outside the expected email store.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents a destructive delete operation (`--delete email-id`) without any warning, safeguard, or confirmation requirement. In an agent-driven workflow, this increases the risk of accidental or automated deletion of important emails, especially because the skill is explicitly designed for autonomous inbox management and heartbeat usage.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Draft email bodies are persisted to plaintext JSON without warning on the compose/save path, even though email content is inherently sensitive and may include credentials, personal data, or internal information. The skill context increases risk because an email-management tool is expected to handle confidential communications, and users may reasonably assume safer handling than silent plaintext storage.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/run-self-tests.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/test-email-manager.js:18