Security audit
Clank Email Monitor
Security checks across malware telemetry and agentic risk
Overview
The skill’s email-monitoring purpose is plausible, but it asks users to grant ongoing mailbox access and mentions automatic replies without enough safety controls or scoping.
Review carefully before installing. Verify the actual email-monitor executable and publisher, use a dedicated least-privilege mailbox or app password, avoid broad IMAP credentials where possible, and keep background monitoring or auto-reply disabled until you confirm there are clear controls for stopping, logging, approvals, and credential protection.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.