Security audit
Security checks for vulnerabilities and agentic risk
This email digest skill is mostly purpose-aligned, but it handles mailbox contents, stored credentials, scheduled monitoring, and external push channels without enough scoping or privacy controls.
Review before installing. Only use this skill with mailboxes and push destinations you explicitly trust, avoid putting SMTP passwords or webhook secrets directly in config files, disable scheduled monitoring unless needed, and confirm exactly what email content will be sent to third-party channels.
The documentation gives conflicting security guidance: it says secrets should come from environment variables, yet elsewhere instructs users to place SMTP credentials directly in a local config file. This increases the chance of credential exposure through filesystem compromise, accidental commits, backups, or overly permissive file permissions.
The skill claims commands run in a 'safe sandbox', but the rest of the document describes execution via host CLI tools, browser sessions, cron, and filesystem access with no actual isolation model shown. This can mislead operators into granting the skill more trust than warranted and may cause execution of potentially harmful commands on the host environment.
The invocation guidance is broad enough to trigger on generic messaging, notification, SMS, and communications tasks, even though the skill is specifically about email digesting and reporting. Overbroad activation can cause the agent to use this skill in inappropriate contexts, increasing the chance of unnecessary data access, message transmission, or unsafe side effects.
The capability keywords are excessively expansive and ambiguous, including broad communication-related phrases that do not tightly map to the skill's true function. In agent environments, this can lead to accidental selection and execution of a privileged skill for unrelated tasks.
The skill explicitly supports pushing email-derived reports and alerts to external channels such as email, Feishu, DingTalk, Slack, webhooks, and callback URLs, but it does not prominently warn about privacy, confidentiality, or third-party transmission risks. Because the data source is mailbox content, misuse could expose sensitive business communications, personal data, or regulated information to external systems.
The documentation instructs users to store push-channel webhooks and SMTP credentials in local configuration files, including a plaintext password field. This is dangerous because such files are often copied, backed up, mispermissioned, or accidentally committed, leading to credential compromise and unauthorized access to messaging infrastructure.
No suspicious patterns detected.
