never-miss

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 8:34 AM UTC
• Version: 1.0.0

Overview

This skill openly automates reminders by reading configured email accounts and writing calendar events, with no evidence of hidden exfiltration or deceptive behavior.

Before installing, understand that this skill can read mail from accounts you configure, store those account passwords in macOS Keychain, create Calendar events automatically during scheduled scans, and keep local reports containing event and email-subject metadata. Use sender allowlists/blocklists and conservative account settings if the mailbox contains sensitive or noisy messages.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (79)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明描述的是一个面向用户的完整提醒/日历自动化技能，而实际代码块只是底层的 ICS 解析与导出模块。它确实与“日历事件/提醒”领域相关，且生成的 .ics 含 VALARM，可作为实现整体技能的一个支持组件；但就此代码块本身而言，主要行为是读写 .ics 文件，而不是声明中的核心功能。尤其缺少与 macOS 系统日历交互、邮件账户访问、定时扫描、跨账户去重、自然语言/截图解析、状态查询等关键能力，因此描述与该代码块实际行为存在明显不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的核心能力是把事项写入 macOS 系统日历并设置提醒，且支持多邮箱定时扫描、跨账户去重、查询提醒/运行状态。实际代码块仅是邮件读取层：通过 IMAP 只读访问邮箱，搜索 UID、抓取邮件、提取正文、解析 .ics 附件，并提供连通性检查与最近邮件/单封邮件读取接口。这可以视为“从邮件中提取日程”的支撑能力，但当前代码没有任何与 macOS 日历/提醒写入相关的实现，也没有去重、定时扫描编排、运行状态查询或‘最近建的提醒’查询功能。与此同时，它执行了声明中未明确表述的直接邮箱读取能力，属于访问资源与主要功能上的明显不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is a calendar/reminder automation skill with email scanning and deduplication features. However, this specific code chunk is only a supporting journal module for recording operational events to a local JSONL file. Logging run status can support the broader skill, but the chunk’s actual behavior is materially narrower than the declared primary purpose and does not itself perform the advertised calendar, reminder, parsing, or mailbox operations. Therefore the description does not accurately represent what this supplied code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的核心能力是解析日程信息并写入系统日历/提醒，同时进行邮箱扫描与去重；而这段代码的实际功能是凭据存储层，专门管理邮箱密码。虽然邮箱扫描功能可能需要凭据管理作为支撑，但当前代码本身并未实现任何日历写入、提醒创建、邮件扫描、截图解析、截止事项识别、跨账户去重或状态查询逻辑。它还包含读取和删除凭据等敏感能力，这些在声明中未明确提及。按评估标准，这属于代码实际能力与声明用途存在明显偏差。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的核心能力是日程提取、日历写入、提醒创建和邮箱扫描去重；而本代码的核心作用是生成运行报告文件。虽然报告中提到 create/duplicate/skip/error 等记录，说明它可能是更大系统中的辅助模块，用于展示“运行状态”，这一点与声明中的“查询运行状态”有一定关联。但就该代码片段本身而言，主要行为并不是日历写入或提醒管理，而是本地 Markdown 报告渲染与落盘，属于 materially different primary purpose。故应判定为描述与该代码片段行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的是一个面向日程提醒自动化的技能，核心能力应包括从文本/截图/邮件中识别事件、访问邮件源、调用 macOS 日历或提醒服务并设置提醒，以及可能的定时任务与去重机制。但给出的代码块仅是通用配置解析组件，用于读取有限 YAML 语法。虽然这类解析器可能作为项目内部辅助模块存在，但就该代码块本身而言，其实际行为与声明用途没有直接对应关系，且完全缺少声明中提到的关键系统访问与业务逻辑。因此应判定为明显不匹配。

Ae1

High

• Category: analysis-evasion

Content

数据目录：`NEVER_MISS_DATA` 环境变量 > 默认 `~/.workbuddy/never-miss`。所有命令用 `python3 scripts/never_miss.py <cmd>`，输出结构化 JSON。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# never-miss 配置（本文件不含密码——密码只存 macOS Keychain）
# 数据目录：本文件所在目录即数据根目录；paths.data 须与其一致（勿改动）
timezone: Asia/Shanghai

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.