Security audit

Email Digest Tool Free

Security checks across malware telemetry and agentic risk

Overview

This email-digest skill is purpose-aligned, but it handles highly sensitive mailbox data and includes risky credential-entry and screenshot-retention guidance that users should review before installing.

Install only if you are comfortable letting the agent access your logged-in mailbox and produce local screenshots or summaries of private email metadata and snippets. Prefer using an already logged-in browser session, do not type or paste mailbox passwords into agent prompts or browser-use commands, and delete generated screenshots and summaries when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill explicitly instructs the agent/user to type email credentials into a browser automation flow. Even though manual login is relevant to accessing mail, embedding credential-entry steps in an agent skill creates a direct path for credential exposure through logs, screenshots, terminal history, model context, or tool telemetry. In the context of an email-summary skill, this is more dangerous because mailbox access can expose large amounts of sensitive personal and business data.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The capability statement claims support for message sending, notification pushing, and communications integration despite the documented behavior focusing on mailbox reading and summarization. This overbroad scope can cause an agent to over-trigger the skill or apply it in contexts involving outbound communications, expanding access expectations and user trust beyond what is actually implemented. In security terms, misleading scope increases the chance of unintended data handling and privilege misuse.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger/scope keywords are overly broad and include generic or unrelated phrases, making the skill easier to invoke outside its intended use. That increases the risk that an agent applies mailbox-reading behavior in inappropriate contexts, potentially collecting or exposing sensitive data when the user did not intend email inspection. Because this skill handles private communications, loose scope matching is more dangerous than for a low-sensitivity utility.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill describes collecting mailbox contents and saving screenshots, but it does not present a clear, immediate privacy warning at the point where sensitive data collection is introduced. Users may not realize that sender names, subjects, snippets, and screenshots can contain confidential personal, financial, or business information that may persist on disk or enter model context. Given that email is inherently sensitive, lack of explicit warning materially increases disclosure risk.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The manual login section includes raw password entry guidance without an immediate warning that credentials may be exposed to the agent runtime, browser automation logs, screenshots, or shell history. This creates a high-risk pattern where sensitive secrets can be handled by components not designed for secure credential entry. In the context of an LLM-driven skill, the danger is elevated because prompts, tool traces, and outputs may retain or leak the secret.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill instructs extraction of private mailbox data including senders, subjects, snippets, and timestamps and returns it in structured output. This creates a straightforward exfiltration path from a private mailbox into agent outputs, logs, downstream tools, or summaries, potentially disclosing sensitive correspondence. The risk is heightened because the extraction is automated and normalized for easy reuse or onward transmission.

Ssd 3

High

Confidence: 96% confidence
Finding: The sample report explicitly surfaces sensitive mailbox contents and pairs them with screenshot retention, making disclosure of real email information a built-in feature rather than an incidental byproduct. Report examples strongly shape agent behavior, so including concrete sensitive fields increases the likelihood of unnecessary exposure in normal use. In an email context, those fields may reveal confidential relationships, financial notices, work priorities, and other private details.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.