Security audit

Send Email

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it lets an agent email arbitrary content and local file attachments externally without clear confirmation or scoping safeguards.

Install only if you trust the agent workflow to send email on your behalf. Before use, verify every recipient, subject, body, and attachment path, and avoid broad automation that could email sensitive local files or private context without an explicit user approval step.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill metadata says it sends emails via SMTP, but the implementation also accepts an arbitrary local attachment path and reads that file into the outbound message. In an agent setting, this creates a clear exfiltration primitive: a prompt or downstream tool invocation could cause sensitive local files such as SSH keys, config files, tokens, or user documents to be attached and emailed off-host without the manifest making that capability explicit.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README instructs the agent to send emails and attachments to external recipients without any warning, confirmation step, or discussion of data sensitivity. In an agentic context, this can normalize exfiltration of local files or confidential content through email, especially when the user asks for broad tasks like emailing reports or documents.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This skill sends user-supplied recipients, subject, body, and optional attachments directly to external email infrastructure with no built-in confirmation, allowlisting, or explicit warning at the point of transmission. In an agent context, that increases the risk of unintended data exfiltration, especially if the agent is induced to email sensitive local file contents or attachments to an attacker-controlled address.

Static analysis

No suspicious patterns detected.