Security audit
Security checks for vulnerabilities and agentic risk
This skill is a read-only Apple Mail metadata search helper, but users should understand it can reveal and export private email details.
Install only if you are comfortable letting the agent query local Apple Mail metadata. Use narrow searches and small limits, avoid broad CSV/JSON exports unless needed, and remember exported files may persist private email subjects, addresses, dates, and attachment names.
The description uses very broad activation phrases like 'find, search, or list emails,' which can cause the skill to trigger on many ordinary user requests without making clear that it will query a sensitive local mail database. Because this skill accesses private email metadata, overly generic routing language increases the risk of unintended invocation and privacy-impacting data access.
The skill documentation does not prominently warn that it queries the user's local Apple Mail SQLite database and can output or export sensitive email metadata such as subjects, senders, recipients, dates, and attachment names. Without a clear privacy warning and consent boundary, users may invoke the skill without understanding that private communications data can be searched, serialized to JSON/CSV, or redirected to files.
No suspicious patterns detected.
