Email Customer Assistant

• Outcome: Review
• Latest audit: May 28, 2026 · 1:52 PM UTC
• Version: 1.0.2

Overview

This is a plausible email assistant, but it needs review because it handles mailbox contents and credentials while several external data flows and controls are under-scoped or inconsistent.

Review carefully before installing, especially on production or regulated mailboxes. Use a dedicated mailbox or app password, restrict folders and Feishu recipients, assume email subjects/snippets/bodies may be sent to configured AI providers and Feishu, and fix or avoid --dry-run if you need a true preview-only mode. Pin dependencies and clarify/remove the token-validation behavior before broader deployment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation makes conflicting safety claims: it says the skill is 'read-only' and does not send email, while earlier sections state it can generate replies and send them after user confirmation. This kind of mismatch can mislead users into granting mailbox access under false assumptions, weakening informed consent and increasing the chance of unintended outbound actions.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The CLI exposes a '--dry-run' flag that promises check-only behavior, but the code never uses this flag to suppress side effects. As written, processing still reaches Feishu push logic via process_emails(), so operators may unintentionally transmit email-derived data externally when they explicitly requested a non-pushing run.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The listing states that the skill fetches email content, classifies it with AI, and pushes alerts/summaries to Feishu, but it does not disclose any privacy boundaries, data minimization, retention, or third-party transmission warnings. Because emails often contain sensitive personal, financial, or business data, sending their contents or derived summaries to external AI APIs and messaging platforms can create unintended data exposure and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly describes pulling email via IMAP, sending content to external AI providers for classification/reply generation, and pushing summaries to Feishu, but it does not clearly disclose privacy boundaries, data handling, retention, consent, or minimization. For a skill processing potentially sensitive customer communications, this creates a real data exposure and compliance risk even if the functionality is intentional.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill asks users to provide highly sensitive credentials, including IMAP account details, app passwords, AI API endpoints, and Feishu webhook/user identifiers, but does not document how those secrets and email contents are stored, processed, retained, or protected. Because the skill processes private mailbox data and forwards summaries to external services, the absence of privacy, retention, and secret-handling guidance materially increases the risk of credential leakage and unintended disclosure of sensitive email content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly states that an AI model analyzes email content and generates reply suggestions, but it does not warn users that full email bodies and potentially sensitive personal or business data may be transmitted to external AI providers. In a mailbox-processing skill, that omission is security-relevant because users may unknowingly expose confidential communications, attachments, or regulated data to third-party services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document advertises automatic IMAP access to arbitrary mailboxes and continuous retrieval of new mail, but does not prominently warn that users must provide mailbox credentials and grant ongoing access to mailbox data. This is dangerous because it normalizes broad, persistent access to sensitive communications without clearly disclosing the trust and exposure implications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Unread email data is sent to external AI classification/reply-generation components and optionally to Feishu, yet this file provides no user-facing notice, consent flow, or clear disclosure at execution time. In a mail-handling skill, that can expose sensitive business or personal content to third parties without the operator fully realizing the data flow.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When AI mode is enabled, the code sends email subject and body/snippet content to an external OpenAI-compatible API endpoint with no built-in consent check, minimization control, or disclosure mechanism. Because emails commonly contain personal, financial, or confidential business data, this can cause unintended data exfiltration to third-party services or untrusted endpoints configured by the operator.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The module sends email-derived data such as sender, subject, date, summary, and optionally reply suggestions to Feishu via outbound HTTP requests, but the code provides no consent flow, disclosure, redaction, or policy gate before transmitting potentially sensitive business or personal information. In an email-handling skill, this is a real privacy and data-governance risk because users may not realize message contents are being forwarded to an external service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The personal-message push path transmits email-related content to Feishu's open platform API using an app token and open_id, again without any built-in notice, consent, or sensitivity filtering. This creates the same external data exposure risk as webhook delivery, and may be more privacy-sensitive because content is routed to an individual recipient account.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Customer email contents, including sender, subject, body, and optional custom instructions, are transmitted to an external AI provider for processing without any built-in consent, disclosure, redaction, or policy gate. In a mail-handling context, this can expose sensitive or regulated data to third parties and create privacy, compliance, and data-governance risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

imapclient>=2.3.0
email>=4.0.0
openai>=1.0.0
pyyaml>=6.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a minimum version only, so builds may resolve to different versions over time, including newly introduced vulnerable or incompatible releases. In a security-sensitive skill, this weakens supply-chain reproducibility and makes incident response and patch verification harder.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

imapclient>=2.3.0
email>=4.0.0
openai>=1.0.0
pyyaml>=6.0
requests>=2.28.0

• Confidence: 95% confidence
• Finding: Using an unpinned version range allows the resolved package to drift across environments and time, which can silently introduce vulnerable or malicious upstream releases. This is a classic software supply-chain weakness even if no exploit is directly present in this file.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

imapclient>=2.3.0
email>=4.0.0
openai>=1.0.0
pyyaml>=6.0
requests>=2.28.0

• Confidence: 94% confidence
• Finding: The open-ended dependency constraint permits non-deterministic installs, increasing the chance of pulling in a compromised or breaking release. For agent skills that may handle credentials or external data, reproducible dependency resolution is important to reduce supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

imapclient>=2.3.0
email>=4.0.0
openai>=1.0.0
pyyaml>=6.0
requests>=2.28.0

• Confidence: 98% confidence
• Finding: PyYAML is both unpinned and separately flagged as having multiple known advisories, which makes the loose version constraint more dangerous because installations may select an unsafe release. If YAML is later parsed unsafely elsewhere in the skill, this can amplify into deserialization or input-validation issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

email>=4.0.0
openai>=1.0.0
pyyaml>=6.0
requests>=2.28.0

• Confidence: 98% confidence
• Finding: Requests is unpinned and also separately identified as having known advisories, so the permissive constraint can result in deployment with vulnerable versions. Given this skill likely performs network operations, a flawed HTTP client dependency can affect credential handling, redirect behavior, or request validation.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The requirements file allows installation of PyYAML versions with known security advisories, including issues related to unsafe deserialization and input validation. In an agent skill that may ingest configuration or content from external sources, vulnerable YAML parsing can lead to code execution or other serious compromise if unsafe loaders are used.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The requirements file permits vulnerable versions of requests with published advisories affecting credential leakage and request/session security behavior. Because this skill likely communicates with external services, exploitation could expose secrets, alter request trust assumptions, or leak authentication material through crafted URLs or network interactions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.