Zoho Mail CLI

• Outcome: Pass
• Latest audit: May 28, 2026, 5:44 AM
• Version:
  0.1.4

Overview

This is a disclosed Zoho Mail command-line skill with sensitive but expected mail access, not evidence of hidden or malicious behavior.

Install only if you trust the external zoho CLI source. Treat Zoho credentials, keyring entries, config files, debug logs, downloaded attachments, and email bodies as sensitive. Require explicit review before sending email, attaching files, deleting mail permanently, or deleting folders.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents destructive operations such as permanent mail deletion and folder deletion, but does not pair them with clear warnings, confirmation guidance, or safe-usage constraints for agent-driven execution. In an automated or scripted context, this increases the risk of accidental irreversible data loss, especially because the skill is explicitly positioned as pipe-friendly and agent-ready.

VirusTotal

64/64 vendors flagged this skill as clean.