Security audit

Email Daily Summary Free

Security checks across malware telemetry and agentic risk

Overview

This skill automates a user-directed daily email summary and saves local email metadata/screenshots, which is sensitive but coherent with its stated purpose.

Install only if you are comfortable letting the agent use your already logged-in browser session to view your mailbox. Store generated summaries and screenshots in a private directory, delete them when no longer needed, and do not use this on mailboxes you are not authorized to access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly automates access to a live mailbox, extracts message metadata and snippets, and archives screenshots, all of which are privacy-sensitive. Without an explicit warning, consent requirement, retention guidance, or scope limitation, users may unintentionally collect and store personal or confidential email data in ways that increase disclosure risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The example workflow writes inbox screenshots to disk and extracts email fields including sender, subject, snippet, and time, which may contain sensitive personal or business information. Because the example normalizes local storage of this data without warning about exposure, file permissions, redaction, or cleanup, it increases the chance of inadvertent data leakage.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.