Security audit

Email News Digest

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform the advertised email digest workflow, but it combines private Gmail access and outbound email sending with weak safeguards and evidence that the produced digest may not reflect the actual email content.

Review this skill before installing. Only use it with a Gmail account and recipients you trust, verify the generated digest before any send action, and avoid broad or sensitive Gmail queries until the summarization is content-derived and the skill adds explicit preview/confirmation safeguards.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill clearly describes reading email content and processing it, which is a sensitive file/data access capability, yet no permissions are declared in the skill metadata. This creates a transparency and consent gap: users may invoke a skill that accesses private email data without an explicit permission boundary or warning, increasing the risk of unintended data exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior promises a general recent-email summarization workflow, but the implementation behavior described by the finding is materially different: it fetches only one message and emits a canned summary unrelated to the actual content. This is dangerous because users may trust the output as an accurate digest of sensitive communications and then redistribute false or misleading content to external recipients.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The function advertises summarization but returns a fixed AI-news template regardless of the provided input, which is a genuine integrity issue for a skill intended to process email content. In this skill context, that can cause misleading or fabricated digest emails to be sent, undermining trust and potentially causing disclosure of unrelated content via the included raw input field.

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The field named `raw_summary` is documented as an LLM-generated summary, but the code stores the full original input text instead. In an email-digest skill, this can unintentionally propagate entire email contents downstream, increasing the risk of sensitive data leakage if the JSON is logged, embedded, or emailed.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill description does not prominently warn that it will retrieve email content and send a generated HTML email to chosen recipients, even though those are high-sensitivity actions involving private data exfiltration channels. In this context, the omission increases danger because the skill combines data access, transformation, and outbound transmission in one flow.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script retrieves raw email content, summarizes it, embeds the resulting content into an HTML digest, and sends it to arbitrary recipients supplied at runtime. There is no consent check, recipient restriction, data classification step, or warning about forwarding potentially sensitive mailbox contents, so this creates a real privacy and data exfiltration risk if the query matches confidential emails or the recipient list is misused.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.