Nylas Email, Calendar & Contacts

• Outcome: Review
• Latest audit: May 29, 2026 at 9:23 PM UTC
• Version:
  1.0.0

Overview

This appears to be a legitimate Nylas email/calendar integration, but it deserves Review because it can read sensitive account data and perform real send, update, and delete actions across auto-discovered accounts without documented confirmation guardrails.

Install only if you trust the Nylas plugin package and are comfortable granting the agent access to the connected accounts behind your Nylas API key. Use the narrowest Nylas grants/scopes possible, avoid broad multi-account keys when unnecessary, and manually confirm any email send, attendee change, event update, or deletion before allowing the action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises tools that can send emails and create, update, or delete calendar data, but it does not prominently warn users that these operations can cause real-world side effects. In an agent context, this omission increases the risk that a user or downstream system invokes destructive or externally visible actions without clear informed consent, especially across multiple connected accounts.

VirusTotal

58/58 vendors flagged this skill as clean.