Signal Pipeline

• Outcome: Review
• Latest audit: May 28, 2026 · 6:10 AM UTC
• Version: 1.1.0

Overview

This skill appears purpose-aligned for signal aggregation, but it reaches into Gmail and other external sources and stores collected data locally without enough scoping or user-control detail.

Review before installing. Use this only with a dedicated newsletter mailbox or tightly scoped Gmail setup, confirm what sources are enabled, inspect where databases are written, and delete stored data when it is no longer needed. The shell command construction should be fixed before accepting configurable queries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_gog(query):
    """Run gog command and return JSON"""
    try:
        result = subprocess.run(
            f"gog gmail search '{query} newer_than:30d' --max 5 --json",
            shell=True,
            capture_output=True,

• Confidence: 96% confidence
• Finding: The code builds a shell command with an f-string and executes it with shell=True, which creates a command-injection sink. Although the current NEWSLETTERS list is hard-coded, the helper accepts arbitrary query input and the shell will interpret quotes and metacharacters if that input ever becomes configurable or is influenced by external data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and instructs use of capabilities including network access, shell execution, and local file/database writes, but does not declare permissions or provide any guardrails. In an agent setting, this can lead to silent collection of external data, Gmail access, and persistent local storage without clear user awareness or consent.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code persists gathered signals and generated drafts to a fixed local path under a user workspace, which expands the skill from transient aggregation into durable storage of potentially sensitive content. In this skill context, signals can come from X, Telegram, RSS, and Gmail newsletters, so writing them to disk and later aggregating them increases privacy and data-governance risk, especially because there is no consent flow, retention policy, directory creation/permission hardening, or minimization of stored content.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to configure Gmail access and notes that data is stored locally in multiple databases, but it does not warn about the sensitivity of email content, retention implications, or the local privacy impact. In a skill that aggregates newsletters and signals from several services, this omission can lead users to ingest personal or sensitive content without informed consent or appropriate safeguards.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The invocation description is broad enough to match many generic requests about trends, content creation, research, or intelligence gathering, increasing the chance the skill is triggered in contexts where the user did not intend external monitoring or mailbox access. Over-broad routing is dangerous here because the skill spans multiple sensitive sources and can persist collected data locally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation omits warnings that the skill may access Gmail newsletters, scrape multiple external sources, and store collected content in local SQLite databases. This lack of transparency can cause users to unknowingly authorize collection of personal or third-party data, with privacy, compliance, and data-retention risks amplified by persistent storage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill accesses Gmail/newsletter data through get_marketing_signals() without any user-facing disclosure, consent gate, or scope transparency. In this specific skill, email access is more sensitive than public RSS/X data because newsletters may include personal inbox metadata, subscription details, and other private content; silent access increases privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This skill accesses Gmail newsletter content via the gog CLI without any user-facing disclosure, consent, or scope limitation messaging. Because mailbox data is sensitive and may include personal or proprietary content beyond intended newsletters, silent access increases privacy and data-governance risk in an agent context.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The code collects content from external services and persists it locally in SQLite without any consent notice, retention policy, or operator-facing disclosure about what is being stored. In a marketing intelligence skill, this increases privacy and compliance risk because scraped content may contain personal data, and silent local accumulation creates an unreviewed data store that could later be misused or exposed.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.