Email Notifier
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill claims to be a generic, cleaned email notifier, but the distributed package contains hard-coded QQ credentials and references scripts that are missing — these inconsistencies warrant caution.
Do not install or run this skill as-is. The package contains a hard-coded QQ mailbox and apparent password, and the documentation references many scripts that are missing — both are red flags. Actions you should take before trusting or running anything from this skill: 1) Ask the publisher for the full source repository and provenance (commit history, maintainer contact). 2) Request a version without embedded secrets; ensure credentials are provided only via documented env/config mechanisms. 3) If you or your organization use the QQ account shown, rotate its password/app-password immediately and check for unauthorized access. 4) If you need email-notifier functionality, prefer an implementation whose code matches its documentation (includes sender/receiver/configurer), or write/inspect the code yourself. 5) If you decide to run code locally for testing, run it in an isolated environment (sandbox/container) and monitor network connections. The inconsistencies here are suspicious even though there is no explicit exfiltration endpoint — the presence of secret material and documentation mismatch are sufficient grounds for caution.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.