Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward email-sending helper, but users should understand that email contents and recipient details are sent through SkillBoss/HeyBossAI's external API.
Install only if you are comfortable using SkillBoss/HeyBossAI as the email processor. Treat recipient lists, CC/BCC, subject lines, and body_html as data sent outside your local environment, and avoid sensitive or regulated content unless your organization approves that provider and API key use.
The skill sends email content, recipient addresses, and optional CC/BCC data to a third-party API, but the documentation does not clearly warn users that this information leaves the local environment. This creates a privacy and data-handling risk because operators may use the skill with sensitive message contents or recipient metadata without informed consent or approval.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests, os
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"
def pilot(body: dict) -> dict:
r = requests.post(
This code performs an outbound HTTPS POST to a third-party API and includes user-supplied email content and recipient data in the JSON body. While external transmission is the intended function of an email-sending skill, it is still security-relevant because sensitive business or personal data could be exfiltrated to an external processor if the user is not adequately informed or if the skill is used in restricted environments.
API_BASE = "https://api.heybossai.com/v1"
def pilot(body: dict) -> dict:
r = requests.post(
f"{API_BASE}/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json=body,
No suspicious patterns detected.