mailgun sender

• Outcome: Pass
• Latest audit: May 28, 2026 at 4:37 AM UTC
• Version:
  1.0.6

Overview

This skill is a straightforward Mailgun email sender, with expected risks around sending real emails through a Mailgun account.

Install this only if you intend the agent to send emails through your Mailgun account. Protect the Mailgun API key, prefer narrowly scoped credentials if available, review message content and recipients before sending, and avoid sending secrets or regulated data unless Mailgun use is approved for that data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill encourages sending email content, recipient addresses, and sender details through Mailgun but does not clearly warn users that this data leaves the local environment and is transmitted to a third-party service. In an agent setting, this omission can cause unintentional disclosure of sensitive message bodies, personal data, or internal operational information to an external provider.

VirusTotal

65/65 vendors flagged this skill as clean.