Security audit

Email Manager

Security checks across malware telemetry and agentic risk

Overview

This is a local JSON email helper with no implemented network sending, but its documentation has confusing claims about SMTP and security guarantees.

This skill appears safe to install as a local email JSON utility, but do not assume it provides secure email storage or real sending. Email bodies are stored in plaintext, and the documentation around SMTP, --send, and path confinement should be clarified before using it with real mailbox data or credentials.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill advertises operational capabilities around email handling, including SMTP credentials and outbound sending, yet the manifest does not declare corresponding permissions. Undeclared capability use is dangerous because it hides the true trust boundary from reviewers and users, making it easier for a skill to access sensitive environment-based configuration or secrets without explicit approval.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The README makes a concrete security claim that the email store is confined to a configured directory, but the documentation shown only describes an override via EMAIL_DIR and does not establish any actual path validation or confinement mechanism. If downstream users or agents rely on this claim, they may trust unvalidated paths and accidentally read from or write to unintended filesystem locations.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The README asserts there is no shell injection because child_process is used with array arguments, but it also states the tool uses execSync for CLI operations, which is a contradictory and potentially unsafe claim. This can mislead reviewers and integrators into assuming command execution is hardened when shell-invoking APIs may still be present, increasing the risk that unsafe argument handling goes unnoticed.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation presents the skill as a local JSON email store with zero external dependencies, but also describes real outbound SMTP sending and plaintext storage of SMTP credentials. This mismatch is dangerous because users may treat the skill as low-risk local storage while it actually introduces credential handling and network-capable behavior, increasing the chance of secret exposure and unintended email transmission.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The file inconsistently states both that --send actively dispatches email via SMTP and that send mode only 'would integrate' with SMTP/API. Ambiguous behavior around external side effects is risky in an agent skill because operators may believe actions are simulated or local when they may in fact transmit data externally, leading to accidental data leakage or unauthorized communication.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/run-self-tests.js:28

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/test-email-manager.js:28