Security audit

AgentMail Integration

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate AgentMail automation skill, but it needs review because its examples and scripts enable high-impact email actions, third-party forwarding, and unsafe attachment saving without enough guardrails.

Install only if you intend to give the skill AgentMail authority to send email, manage inboxes, and configure webhooks. Use sender allowlists, require approval before outbound replies or forwarding, avoid bulk or unsolicited sending, save attachments only to a restricted directory with sanitized filenames and scanning, and use trusted webhook endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill demonstrates capabilities involving environment variable access and local file read/write via code examples and referenced scripts, but it declares no permissions. This can mislead operators and downstream policy systems about what the skill is able to access, reducing review quality and enabling overprivileged or opaque execution in agent environments.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The example explicitly forwards email metadata and body content to a third-party Slack webhook, which extends the skill from email handling into external data sharing. Even as sample code, this can normalize exfiltration of potentially sensitive message contents without minimization, consent, or clear warnings about privacy and compliance implications.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The multi-inbox load-balancing pattern explicitly creates a pool of inboxes and distributes outbound messages across them, which enables bulk messaging behavior beyond a narrow transactional email integration. In the context of an agent email automation skill, this can facilitate spam campaigns, evasion of sender reputation controls, or policy-violating mass outreach if adopted without strict guardrails.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation text is overly broad, telling the agent to use the skill for general email setup, sending, receiving, workflows, and replacing traditional providers. Broad invocation criteria increase the chance the skill is selected in contexts where sensitive email actions or untrusted inbound content are involved, expanding exposure to prompt injection and data handling risks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The send-message example encourages transmission of email bodies, recipients, and attachments to an external email service without any warning about data disclosure or consent requirements. In an agent automation context, this omission is risky because developers may wire sensitive prompts, user data, or files into outbound email flows without realizing they are leaving the local trust boundary.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The webhook example shows forwarding message events to an arbitrary HTTPS endpoint but does not warn that email-derived event data and metadata will be delivered to a third-party service. In this skill's context, incoming email workflows may contain sensitive content, so developers could unintentionally exfiltrate message data to external infrastructure they do not control adequately.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This snippet sends email-derived content to Slack without any user-facing disclosure that message data leaves the AgentMail context and is shared with a separate third-party service. That creates a privacy and data-handling risk, especially if users copy the example into production and forward confidential or regulated content.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The attachment processing example automatically downloads untrusted email attachments and writes them to disk without validation, sandboxing, or user confirmation. This creates a risky default pattern that can expose downstream parsers and local storage to malicious files, path-related filename issues, or unsafe automated processing of attacker-controlled content.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The digest summary pattern forwards previews and metadata from collected emails to another recipient, potentially disclosing sensitive or private content without sender consent or data-classification checks. In an email automation skill, this is especially risky because emails often contain credentials, personal data, internal discussions, or regulated information.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The auto-responder pattern sends automatic replies based on inbound email content and stored conversation context, with no approval step, recipient restrictions, or safeguards against data leakage. This can cause unintended outbound messages, disclosure of internal context, or abusive reply loops when interacting with attacker-controlled or automated senders.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script writes attachment contents directly to a path derived from the server-controlled filename (`att.filename`) without warning the operator, sanitizing the name, or checking for overwrite/path traversal conditions. In an email-processing context, attachments are untrusted input, so a crafted filename could overwrite existing files in the target directory or escape it if path components are accepted by the filesystem layer.

External Transmission

Medium

Category: Data Exfiltration
Content: }] } requests.post(SLACK_WEBHOOK, json=payload) # Watch and forward for message in client.inboxes.messages.watch("alerts@agentmail.to"):
Confidence: 94% confidence
Finding: requests.post(SLACK_WEBHOOK, json=

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/WEBHOOKS.md:12

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:179