Email Auto Reply

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:43 AM UTC
• Version: 1.0.0

Overview

This skill is a simple local email reply template manager, with no evidence of email sending, network access, credential use, or hidden execution.

Install only if you want a Chinese-language local CLI for managing and testing keyword-based reply templates. Be aware it stores rules in ~/.email_auto_reply.json and does not actually connect to email accounts, send replies, handle multiple accounts, or perform automatic CC despite those claims in the description.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

keywords = rule.get("keywords", [])
        for kw in keywords:
            if kw.lower() in text:
                return rule
    
    return None

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises commands that invoke a local Python script and static analysis detected file read/write capability, but the manifest does not declare any tool scope or permissions. This creates a transparency and least-privilege problem: users and platforms cannot accurately assess what the skill may access, increasing the chance of unintended file operations or misuse.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are generic email terms such as '自动回复' and '邮件回复', which are likely to match ordinary user requests unrelated to this specific skill. Broad activation can cause the skill to run unexpectedly in contexts involving email drafting or handling, leading to accidental automated replies or exposing users to behavior they did not intend to invoke.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The feature list includes automatic reply behavior and automatic CC, but the description does not clearly warn users that emails may be sent or copied automatically. Missing disclosure around outbound communication can lead to privacy, reputational, or operational harm if messages are sent to unintended recipients or copied without explicit awareness.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest promises an email auto-reply tool suitable for automatic email responses, but the implemented CLI only supports adding, listing, deleting, and testing local templates. There is no code that connects to an email system, monitors messages, or sends replies, so the actual behavior is substantially narrower than the stated functionality.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The natural-language description and usage instructions are presented entirely in Chinese, with no indication that language choice is optional or configurable. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This code includes user-facing descriptions, help text, and status messages primarily in Chinese, such as the module title, command help, and printed output. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy issue because no alternative locale or language selection is offered.

Static analysis

No suspicious patterns detected.