Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward email-sending helper that uses a disclosed third-party API and does not show hidden persistence, privilege escalation, or unrelated data access.
Install only if you intend to send email through SkillBoss API Hub. Review recipient lists and message bodies carefully, and avoid sending secrets, regulated data, or sensitive business information unless your organization approves that provider and API key usage.
The skill sends recipient addresses, subject lines, and HTML email content to a third-party API service, but the description does not clearly warn users that this data leaves the local environment. This can cause unintentional disclosure of sensitive personal, business, or regulated information because users may assume the skill only uses a local mail client or first-party channel.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests, os
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"
def pilot(body: dict) -> dict:
r = requests.post(
This code performs a live POST request to an external service and includes the full email payload in the JSON body, which necessarily transmits recipient lists, message content, and possibly sensitive business information off-host. In the context of a communication skill this behavior is expected, but it is still security-relevant because it creates data exfiltration and third-party handling risk if users are not clearly informed and if sensitive content is sent.
API_BASE = "https://api.heybossai.com/v1"
def pilot(body: dict) -> dict:
r = requests.post(
f"{API_BASE}/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json=body,
No suspicious patterns detected.