Manage Email

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 1.1.1

Overview

This email-management skill is purpose-aligned, but it gives agents broad mailbox authority without enough guardrails for sending, deleting, batch actions, or account removal.

Review before installing. Use this only if you are comfortable giving the CLI access to your mailbox, and require explicit confirmation before sends, deletes, batch moves, draft deletion, or account removal. Prefer a pinned or otherwise verified CLI version instead of installing the latest package globally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation of a Third-Party Email Client

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–13
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Installation (if needed)
npm install -g @laffy1309/emailcli

Technical Analysis

The skill instructs the agent to install @laffy1309/emailcli directly from the npm registry without specifying a version, integrity hash, lockfile, verified source repository, or publisher-verification procedure. Consequently, the installed code can change after the skill has been audited.

The global installation flag (-g) increases exposure by placing the package and its executable in a shared environment. npm installation may also execute package lifecycle scripts with the invoking user's permissions. After installation, the client is expected to receive authorization to read and modify Gmail or Outlook mailboxes, making dependency compromise particularly consequential.

This finding represents a supply-chain weakness rather than evidence that the named package is currently malicious.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a future package release.
2. The attacker publishes a modified version containing malicious lifecycle or runtime code.
3. An agent follows the skill instruction and executes:

   bash

   npm install -g @laffy1309/emailcli
   

4. npm retrieves the current mutable package release and executes any applicable lifecycle scripts with the installing user's privileges.
5. The globally installed mail-cli executable is subsequently invoked for mailbox operations.
6. Malicious code can abuse the process's local permissions and any mailbox credentials or authorization tokens available to the client.

Impact Assessment

A compromised dependency could execute code with the installing user's operating-system privileges. Within the email wo ...[truncated 464 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version rather than installing the latest mutable release.
2. Record and verify the package integrity hash before installation.
3. Provide the authoritative source repository and establish a publisher and provenance verification process.
4. Use a lockfile or another reproducible dependency mechanism.
5. Prefer a project-local or isolated installation instead of a global installation.
6. Disable npm lifecycle scripts where operationally feasible, or inspect and explicitly approve them before execution.
7. Run the client with least-privilege host and mailbox permissions.
8. Periodically audit the pinned package, its transitive dependencies, and any changes before upgrading.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata says email-related commands 'should always use this skill' and broadly covers common requests like checking inboxes, sending, deleting, and organizing mail. That wide activation scope can cause the agent to route many ordinary requests into a high-impact tool without explicit guardrails, increasing the chance of unintended email access or actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents destructive capabilities such as deleting emails, moving to trash, and removing accounts, but does not instruct the agent to warn the user or obtain confirmation before executing irreversible or disruptive actions. In an email-management context, this materially raises the risk of accidental data loss, account disconnects, or mailbox tampering from misunderstood prompts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md

1. List drafts with `mail-cli drafts --list`
2. Load a draft with `mail-cli send --draft <id>`
3. Override any fields with command-line flags (CLI takes precedence over draft data)
4. Draft is automatically deleted after successful send

### Search and Act
1. Run `mail-cli search` with appropriate query syntax

Static analysis

No suspicious patterns detected.