Security audit

email-163

Security checks across malware telemetry and agentic risk

Overview

This email automation skill is broadly aligned with its purpose, but it needs review because it can send, delete, archive, and schedule mailbox actions with weak guardrails around secrets and destructive operations.

Review this skill before installing in any real mailbox. Use a test account first, keep bulk sends in dry-run until recipients and content are verified, require explicit approval for large sends and deletes, avoid broad scheduled delete rules, and store 163 authorization codes in an environment variable, keychain, or managed secret store rather than plaintext config files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documented input/output schema is a generic grading/audit result format that does not match the stated email-management behavior of the skill. This mismatch can cause an integrating agent to mis-handle outputs, make unsafe assumptions about task success, or route email operations through the wrong trust path, increasing the chance of logic abuse or silent failure.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill first claims no API key is needed, then later instructs users to configure generic API keys and tokens. Contradictory authentication guidance is dangerous because operators may provision unnecessary secrets, expose credentials to the wrong component, or authenticate against unintended services.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill promotes bulk sending and mass notification features but does not clearly warn about recipient privacy, accidental mass delivery, consent, or anti-spam/rate-limit implications. In an email automation context, this increases the risk of unintended data disclosure, misuse of recipient lists, and large-scale sending errors.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The documented scheduled workflow includes automatic deletion via a piped action string without a clear destructive-operation warning, preview step, or rollback guidance. In a mail-management skill with scheduling and exec capability, this can lead to unattended mass deletion of messages from a broad folder scope.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The configuration examples store mailbox passwords or authorization codes directly in JSON files without a strong warning against plaintext secret storage. Because this skill manages multiple accounts and supports write/exec operations, exposed config files could grant direct mailbox access, message sending capability, and access to archived data across accounts.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.