Security audit

Email Ledger

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned but needs review because it can parse sensitive email attachments, upload the resulting ledger, and has unsafe ZIP and Excel handling.

Install only if you are comfortable with the agent parsing the provided email files, storing summaries and addresses in an XLSX, and uploading that workbook through a separate uploader. Use trusted, reasonably sized ZIPs, avoid opening generated ledgers from untrusted emails without spreadsheet protections, and prefer adding explicit confirmation before upload and cleanup/size limits before broad use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/parse_emails.py:497
Finding: Excel Formula Injection Through Attacker-Controlled Email Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/parse_emails.py:385
Finding: Unbounded ZIP Extraction and Email Loading Permit Resource-Exhaustion Attacks
Content: View full analysis
Remediation: View remediation
MAX_ENTRIES: raise ValueError("Archive contains too many entries") total_size = 0 for info in entries: total_size += info.file_size if info.file_size > MAX_FILE_SIZE: raise ValueError("Archive entry exceeds the size limit") if total_size > MAX_TOTAL_SIZE: raise ValueError("Archive exceeds the expanded-size limit") compressed = max(info.compress_size, 1) if info.file_size / compressed > MAX_COMPRESSION_RATIO: raise ValueError("Suspicious archive compression ratio") with tempfile.TemporaryDirectory(prefix='email_ledger_') as tmp_dir: # Extract only validated .eml entries and process them here. pass ``` Before reading an email, check its size: ```python if os.path.getsize(filepath) > MAX_FILE_SIZE: raise ValueError("Email exceeds the size limit") with open(filepath, 'rb') as f: msg = email.message_from_bytes(f.read(MAX_FILE_SIZE + 1)) ``` Temporary files sho ...[truncated 126 chars]

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger logic is overly broad, including generic phrases like '整理一下' or '帮我登记' when any attachment exists in context, which can cause the skill to activate in conversations where the user did not intend email parsing or ledger generation. Because the skill processes attachments and later uploads generated output, accidental invocation could lead to unauthorized handling of sensitive email contents and metadata.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill declares no explicit tool scope or permissions boundaries while instructing access to user-provided files and local paths, which creates unnecessary ambiguity about what filesystem access the skill may exercise. In a file-processing skill that handles archives, templates, and workspace outputs, missing least-privilege declarations can enable broader-than-expected file reads if the runtime or agent interprets paths permissively.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The applicable scenarios rely on ambiguous keyword matching such as '报备台账', '邮件台账', and '整理邮件' without clear exclusions, increasing the chance the skill will claim requests outside its intended scope. In this context, incorrect activation is risky because the skill is designed to inspect archives and extract structured data from potentially sensitive communications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs uploading the generated Excel ledger and returning a download URL, but it does not require informing the user that parsed email contents and metadata will be transmitted to another service or storage location. Since the output may contain sensitive business correspondence details, this can create a privacy and data-handling risk through silent exfiltration beyond the immediate processing environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code extracts ZIP contents to a temporary directory and later writes parsed email metadata and body summaries into an XLSX file. Although the script logs progress, it does not disclose that it will persist potentially sensitive email content and addresses to disk or that ZIP contents will be unpacked locally, which is a user-facing safety warning gap for data-affecting operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 该文件全文以中文编写并直接给出操作性规则，但未说明这是仅适用于中文邮件场景，或是否支持其他语言/地区输入。按组织语言/locale 政策标准，这构成了默认强制单一语言而缺少用户选择或明确范围说明的自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Natural-language strings in the file, including the top-level documentation and command descriptions, force a specific language/locale experience. The policy allows locale constraints when explicitly documented and justified or when users are given a choice, but neither is present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.