Security audit
Security checks for vulnerabilities and agentic risk
This skill is a mailbox automation helper, but it asks agents to reuse logged-in browser sessions, extract email metadata and snippets, save screenshots and plaintext reports, and optionally run on schedules.
Install only if you are comfortable giving an agent access to already logged-in webmail sessions and letting it write email summaries, snippets, subjects, senders, timestamps, and screenshots to local files. Use a dedicated output directory with restricted permissions, avoid broad multi-account runs unless explicitly needed, review any cron or launchd schedule before enabling it, and delete reports/screenshots when no longer needed.
The skill presents conflicting security claims: it advertises automatic anti-crawling evasion while elsewhere stating verification cannot be bypassed. This inconsistency is dangerous because it normalizes or encourages stealthy automation against email providers and can mislead operators about what behavior is acceptable or expected.
The skill claims logs will not record sensitive content, yet it instructs saving reports and screenshots containing sender, subject, timestamps, and sometimes snippets. Even if bodies are excluded, this metadata is still sensitive and can expose business relationships, account activity, and confidential topics if stored insecurely.
The skill is explicitly designed to collect, aggregate, and export mailbox data across accounts, including sender, subject, snippets, and screenshots, to local reports. This creates a substantial privacy and data-handling risk because highly sensitive communications metadata and content-adjacent information are copied outside the mail provider into agent-accessible local storage.
The examples operationalize bulk extraction of email data and appending it into consolidated Markdown reports across multiple accounts. In context, this makes the risk more serious because it is not hypothetical documentation; it is actionable guidance for exporting sensitive mailbox information into easily copied plaintext artifacts.
Saving inbox screenshots and retaining reports on disk can expose sensitive communications, contacts, and subject lines well beyond what is needed for summarization. Screenshots are especially risky because they may capture unexpected on-screen data that bypasses later redaction or filtering controls.
No suspicious patterns detected.
