Security audit

邮件日报专业版

Security checks for vulnerabilities and agentic risk

Overview

This email digest skill is mostly purpose-aligned, but it handles mailbox contents, stored credentials, scheduled monitoring, and external push channels without enough scoping or privacy controls.

Review before installing. Only use this skill with mailboxes and push destinations you explicitly trust, avoid putting SMTP passwords or webhook secrets directly in config files, disable scheduled monitoring unless needed, and confirm exactly what email content will be sent to third-party channels.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation gives conflicting security guidance: it says secrets should come from environment variables, yet elsewhere instructs users to place SMTP credentials directly in a local config file. This increases the chance of credential exposure through filesystem compromise, accidental commits, backups, or overly permissive file permissions.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill claims commands run in a 'safe sandbox', but the rest of the document describes execution via host CLI tools, browser sessions, cron, and filesystem access with no actual isolation model shown. This can mislead operators into granting the skill more trust than warranted and may cause execution of potentially harmful commands on the host environment.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The invocation guidance is broad enough to trigger on generic messaging, notification, SMS, and communications tasks, even though the skill is specifically about email digesting and reporting. Overbroad activation can cause the agent to use this skill in inappropriate contexts, increasing the chance of unnecessary data access, message transmission, or unsafe side effects.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The capability keywords are excessively expansive and ambiguous, including broad communication-related phrases that do not tightly map to the skill's true function. In agent environments, this can lead to accidental selection and execution of a privileged skill for unrelated tasks.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill explicitly supports pushing email-derived reports and alerts to external channels such as email, Feishu, DingTalk, Slack, webhooks, and callback URLs, but it does not prominently warn about privacy, confidentiality, or third-party transmission risks. Because the data source is mailbox content, misuse could expose sensitive business communications, personal data, or regulated information to external systems.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The documentation instructs users to store push-channel webhooks and SMTP credentials in local configuration files, including a plaintext password field. This is dangerous because such files are often copied, backed up, mispermissioned, or accidentally committed, leading to credential compromise and unauthorized access to messaging infrastructure.

Static analysis

No suspicious patterns detected.