Security audit

OpenMail

Security checks for vulnerabilities and agentic risk

Overview

OpenMail is a coherent email integration that clearly gives the agent real email abilities, with user-visible controls for inbound behavior and credential scope.

Install this only if you want the agent to send and receive real email. Use notify or tool mode if you do not want automatic replies, prefer inbox-scoped keys unless you intentionally need pod-wide access, and remember that pod mode covers every inbox in the pod and lets the agent create more inboxes.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description contains broad trigger phrases like 'reach out to them', 'contact support', 'sign up', and 'wait for their reply' that can activate the email capability even when the user did not explicitly ask to use email. Because this skill can send real external messages, ambiguous routing increases the chance of unintended outreach, privacy mistakes, or actions taken on the user's behalf without clear confirmation.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/cli.js:62
Evidence: const child = spawn(process.execPath, [resolveBundledCliPath(), ...args], {