Security audit

Email Sender Policy

Security checks across malware telemetry and agentic risk

Overview

This is a real Gmail-sending skill, but it can send live email through Maton/Gmail from broad triggers without an enforced confirmation step.

Review carefully before installing if you do not want an agent to send real email from your connected Gmail account. Use --test or a draft/preview workflow first, verify To/CC/BCC and the active Maton/Gmail connection, and avoid regulated or confidential content unless you are comfortable with Maton/Gmail processing the message.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill explicitly documents access to environment secrets (`MATON_API_KEY`) and outbound network transmission to `gateway.maton.ai`, yet no permissions are declared. In a subagent that can send email on the user's behalf, this creates hidden capability escalation and prevents users or platforms from making an informed trust decision before execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented behavior understates the actual operational scope: local file reads, newsletter formatting, possible CC/BCC usage, test/output modes, and relay through `gateway.maton.ai` using an API key are materially different from a simple formatting policy skill. This mismatch can mislead users into exposing local data or authorizing message transmission under false assumptions about what the skill does and where data goes.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The manifest says the skill uses the current logged-in Gmail connection, but the implementation instead reads a MATON_API_KEY from the environment and uses it to send mail. This discrepancy is security-relevant because it can mislead users and reviewers about the trust boundary, authentication model, and which account or gateway is actually authorized to send messages.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents outbound email sending via Gmail/Maton but does not clearly warn users that recipient addresses, subject lines, and message bodies will be transmitted to external services. In an agent context, this omission can lead users to unknowingly route sensitive or regulated data through third-party infrastructure, increasing privacy, compliance, and accidental data-disclosure risk.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Broad triggers like `send email` and `寄信` can cause this subagent to activate for ordinary conversation or loosely related requests, increasing the chance of unintended email composition or transmission. Because this skill performs external actions and uses authenticated connections, accidental invocation is more dangerous than for a read-only formatting tool.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The natural-language trigger guidance broadens activation to vague intents like helping send mail, adjusting encoding, or converting tables, without clear separation between formatting-only and send-email actions. This can cause the skill to intercept routine drafting tasks and escalate them into authenticated outbound email workflows.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill sends user-provided content and recipient metadata to an external API endpoint but does not clearly warn about privacy, data handling, or third-party transfer implications. Users may assume a local formatting-only operation while sensitive message contents are actually transmitted off-agent for delivery.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 84% confidence
Finding: The trigger `寄信` is extremely short and generic, making accidental activation likely in ordinary chat. Since the skill can access authenticated email-sending pathways, even a low-complexity trigger increases the risk of unintended invocation and downstream privacy or integrity impacts.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:184