Security audit

Porteden Email

Security checks across malware telemetry and agentic risk

Overview

This email skill is not clearly malicious, but it needs review because it can read and send email, manage accounts, and write attachments while using broad command pass-through and unsupported privacy claims.

Install only if you trust the Porteden CLI and are comfortable granting agent-assisted access to your mailbox. Before using it, restrict which account it can use, review every send/download action manually, avoid sensitive mailboxes, and prefer a safer wrapper that removes arbitrary argument pass-through, avoids Invoke-Expression, confirms outbound email, and confines attachment downloads to a dedicated folder.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The skill claims that no email content is uploaded to third-party servers and that all operations are local, but the documented workflow clearly relies on the Porteden CLI/service for login, email access, search, sending, and attachment handling. This can mislead users into exposing sensitive email content or metadata to an external service under false privacy assumptions, which is especially dangerous for enterprise or regulated data.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The wrapper exposes account-management and authentication-related commands such as accounts, login, and logout even though no constrained skill purpose or authorization boundary is defined. In an agent context, this broadens the skill beyond simple mail retrieval/sending and can let a caller switch profiles or alter authentication state, increasing the risk of misuse or access to unintended mail accounts.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script forwards arbitrary RemainingArgs to the underlying CLI for accounts and attachments, and also appends extra arguments for other commands. This creates a capability escape where callers can invoke undocumented flags or subcommands and potentially reach dangerous behavior not represented by the wrapper's declared parameters.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The attachments flow allows downloading email attachments to a user-controlled output path, which gives the skill arbitrary file-write capability through the mail client. In an agent environment this can be abused to overwrite files, place payloads in sensitive locations, or stage data on disk outside the intended workspace.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents actions that can send email and write files to disk, but it does not clearly warn that these are side-effecting operations. Users or downstream agents may treat the commands as read-only helpers and unintentionally send messages, download attachments, or export potentially sensitive files into local directories.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The send command transmits email based on parameters without any explicit confirmation or warning about recipients, subject, body, cc, bcc, or attachments. In an agent-driven workflow, this can lead to unintended external data disclosure or message delivery if the action is triggered from ambiguous or manipulated input.

Missing User Warnings

Low

Confidence: 73% confidence
Finding: The attachment download operation creates files at the specified output path without any clear warning that disk writes will occur. While less severe than unrestricted argument forwarding, it still increases the chance of unsafe or unexpected file creation in automated usage.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.