Security audit

邮件日报免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill’s email-digest purpose is legitimate, but it asks for sensitive mailbox and browser-session access with unsafe credential and data-retention guidance.

Install only if you are comfortable giving the agent/browser automation access to your mailbox. Prefer an already-authenticated browser session, do not type real passwords into command-line examples, pin and review dependencies before installation, and avoid saving inbox screenshots or detailed sender/subject reports unless you have a clear retention and deletion plan.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:161
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:263
Finding: Mailbox Password Passed Through a Command-Line Argument
Content: View full analysis
"your-password" ``` ### Technical Analysis The documented manual-login workflow instructs the user to provide a mailbox password as a command-line argument. If the placeholder is replaced with a real password, the credential may be exposed through one or more of the following channels: - Process-command-line inspection while the command is running. - Shell or terminal history. - Agent execution transcripts. - Command audit logs and telemetry. - Error reports or debugging output. - Wrapper scripts that record invoked commands. Although another section recommends using environment variables for sensitive information, the actual login example places the password directly in the command. Environment variables would also require careful handling because they may be observable in some environments, but they avoid embedding the password directly in shell history and command transcripts. ### Attack Path 1. A user follows the manual-login example. 2. The user or Agent replaces `"your-password"` with the real mailbox password. 3. The command is executed or stored in a reusable script. 4. The plaintext command is recorded in shell history, an Agent transcript, process telemetry, or command logs. 5. Another local user, administrator, log reader, support operator, or party with transcript access retrieves the credential. 6. The attacker authenticates to the mailbox, subject to any configured multifactor authentication and provider controls. ### Impact Assessment Exposure of the credential could permit unauthorized mailbox authentication with the privileges of the affected account. Potential consequences include: - Reading private and business email. - Searching historical messages for addition ...[truncated 570 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims safer handling by avoiding stored passwords, yet later instructs direct password entry in commands. That can expose credentials through terminal history, agent logs, telemetry, screenshots, or prompt traces, creating a straightforward credential leakage risk.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly directs extraction and preservation of mailbox contents, including message metadata and screenshots. Email inbox data is inherently sensitive; normalizing bulk extraction and archival increases the risk of privacy violations, inadvertent disclosure, and secondary data retention beyond the user's original mailbox controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manual login example shows the password being entered directly through an automation command, which can leak secrets into command history, agent transcripts, logs, and debugging output. Because this skill handles mailbox access, a leaked credential can immediately compromise highly sensitive communications data.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The sample output reproduces private inbox details such as sender identities and email subjects, legitimizing the copying of sensitive communications content into generated reports. This expands exposure surface because reports may be logged, shared, indexed, or stored less securely than the mailbox itself.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description says the skill should be used for '消息发送、通知推送、邮件短信、通信集成', which implies outbound messaging or broader communications integration. The actual file only documents browser automation to log into mailboxes, read inbox state, extract message metadata, and take screenshots for summaries; there is no sending, SMS, or push-notification capability described or implemented.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Overly broad invocation phrases can cause the skill to be selected for communication tasks well beyond email summarization, including potentially sensitive message-handling scenarios. In an autonomous agent environment, ambiguous routing increases the chance of the skill being used with higher-risk inputs and side effects than intended.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description states '支持中文交互' and the feature section says the skill '涵盖中文交互等核心能力', but the document does not present language as an option or explain a necessary locale limitation. This can violate language/locale policy when a skill appears to prescribe a specific interaction language without explicit user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The line describes the skill as covering '中文交互' as a core capability, but does not clarify whether other languages are also allowed. Without an explicit choice or justified region-specific constraint, this reads as a locale-specific default imposed by the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to capture and store mailbox screenshots, which may include sensitive email subjects, senders, previews, and account metadata. Without strong warnings, redaction, retention limits, and consent boundaries, this creates avoidable privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is granted exec and documents shell execution patterns beyond the minimum needed for mailbox summarization, increasing the attack surface for command misuse. In an agent setting, unnecessary command execution guidance can be repurposed to run unintended local operations or destructive filesystem actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The '核心功能' section asserts generic capabilities like file parsing/writing and external API integration, which are not supported by the rest of the document's actual workflow. This is not just incomplete documentation; it actively broadens the stated intent beyond the implemented email-browser automation behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest advertises '输出结果可直接使用' and '提供结构化输出和错误处理机制', but the file mainly shows browser-use state/eval/screenshot commands and a shell script that echoes status lines. While there are example JSON snippets, the documented workflow does not consistently define or enforce a structured digest output format or substantive error-handling logic beyond troubleshooting notes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation recommends using find ... -delete to remove stored screenshots, which permanently deletes files. There is no nearby caution that this operation is destructive, so users may run it without understanding the data-loss impact.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.