Iris Pro — AI Inbox Intelligence

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:03 AM UTC
• Version: 1.0.4

Overview

Iris Pro is a Gmail triage skill, but it needs review because it under-discloses sensitive Gmail access, saves inbox details locally, and uses an unsafe package install command.

Review this before installing. Use it only if you are comfortable giving the skill a Gmail app password and having message subjects, senders, classifications, and generated reply drafts saved as local files. Prefer running it in a private directory and isolated Python environment, avoid synced or version-controlled folders, and revoke the Gmail app password when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:83

Finding

Unpinned Dependency Installation Bypasses System Package Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:83
Vulnerability Type: Unpinned third-party dependency installed into the system Python environment
Risk Level: Medium

Vulnerable Code:

bash

pip3 install rich --break-system-packages --quiet

Technical Analysis

The installation command retrieves the latest available version of rich without a version constraint or integrity hash. Consequently, the dependency resolved during installation can differ from the version reviewed or tested by the Skill author.

The --break-system-packages option bypasses Python's externally managed environment protection. This can modify the host's system-level Python environment, introduce dependency conflicts, or replace packages used by other applications. Python package installation can also execute package build or installation logic, making an upstream compromise relevant to local code execution.

No evidence shows that rich itself is malicious. The vulnerability is the unsafe and non-reproducible dependency installation process.

Attack Path

1. An attacker compromises the dependency's publishing account, distribution artifact, or an upstream package involved in dependency resolution.
2. A user follows the Skill's installation instructions.
3. pip3 resolves and downloads the currently published package rather than a reviewed, hash-verified version.
4. Malicious package installation logic executes with the privileges of the user running the command.
5. Because system package safeguards are bypassed, the installation can also alter the shared Python environment and affect unrelated Python applications.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip3. The attacker could access that user's files and environment variables, including Skill credentials if they are present in the same execution environment. If the installation is run by a ...[truncated 232 chars]

Remediation

View remediation

Remediation Suggestions

• Install dependencies inside a dedicated virtual environment rather than the system Python environment.
• Remove --break-system-packages.
• Pin rich and all transitive dependencies to reviewed versions.
• Use a lock file or requirements file containing cryptographic hashes, and install with pip install --require-hashes.
• Review and update pinned packages through a controlled dependency-update process.
• Avoid running package installation commands as root or another privileged account.
• Where feasible, package the Skill in a reproducible, isolated environment with pre-audited dependencies.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:359

Finding

Sensitive Gmail Metadata and Reply Drafts Are Persisted in Plaintext

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:359-377
Vulnerability Type: Plaintext storage of sensitive email-derived information with default file permissions
Risk Level: Medium

Vulnerable Code:

python

with open(report_file, "w", encoding="utf-8") as f:
    f.write(f"# 🌈 Iris Pro — Inbox Report — {date_str}\n\n")
    f.write(f"**Scanned:** {len(emails_data)}  **Actionable:** {len(actionable)}  **Need reply:** {len(unreplied)}\n\n")
    f.write("## Priority Emails\n\n| Score | Cat | From | Subject | Age |\n|---|---|---|---|---|\n")
    for e in actionable[:30]:
        age_str = f"{int(e['age_hours'])}h" if e["age_hours"] < 48 else f"{int(e['age_hours']//24)}d"
        f.write(f"| {e['urgency']} | {e['category']} | {e['sender']} | {e['subject']} | {age_str} |\n")
    f.write("\n## Draft Replies\n\n")
    for e in unreplied[:20]:
        f.write(f"### Re: {e['subject']}\n\n{FENCE}\n{gen_draft(e)}\n{FENCE}\n\n")

with open(json_file, "w", encoding="utf-8") as f:
    json.dump({
        "date": date_str, "scanned": len(emails_data),
        "actionable": len(actionable), "need_reply": len(unreplied),
        "emails": [{"subject": e["subject"], "sender": e["sender"],
                    "urgency": e["urgency"], "category": e["category"]} for e in actionable]
    }, f, indent=2)

Technical Analysis

The Skill writes inbox-derived data to Markdown and JSON files in the current working directory. Persisted fields include sender names, email subjects, inferred categories, urgency scores, and generated reply drafts. Subjects and drafts may reveal personal information, legal matters, financial activity, customer details, internal projects, or other confidential communications.

Files are created through the standard open(..., "w") interface without explicitly enforcing restrictive permissions. Their effective permissions therefore depend on the process umask and surrounding filesys ...[truncated 1913 chars]

Remediation

View remediation

Remediation Suggestions

• Make report persistence opt-in and clearly warn users which fields will be stored.
• Default to terminal-only output when persistent reports are not explicitly requested.
• Create reports atomically with owner-only permissions such as 0600, independent of the user's umask.
• Require or configure a dedicated private output directory and reject unsafe shared directories.
• Minimize stored data by omitting or redacting sender names, subjects, and draft bodies unless explicitly requested.
• Offer encrypted report storage when sensitive content must be retained.
• Add configurable retention and secure cleanup controls.
• Warn users not to create reports inside source repositories, shared folders, or automatically synchronized directories.
• Document that reports contain inbox-derived sensitive information even though Gmail credentials are not included.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill makes a materially misleading security claim: it states that 'No data transmitted to any server,' yet the code logs into Gmail over IMAP, sending mailbox credentials to Gmail and retrieving email headers and body snippets from a remote server. Users may rely on this false assurance when deciding to provide sensitive credentials and permit mailbox access, which increases the risk of uninformed consent and mishandling of highly sensitive email data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill writes inbox-derived reports and generated draft replies to local Markdown and JSON files without prominently warning users in the description or security notes. Those files can contain sensitive email subjects, sender identities, categories, and suggested reply content, creating a confidentiality risk on shared machines, synced folders, backups, or other tools that later ingest local workspace files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.