Email Multi Provider Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.0

Overview

This email-management skill is coherent, but it asks users to install and authenticate an unpinned third-party CLI that can read, send, modify, and delete mailbox data.

Review this skill before installing. Prefer browser OAuth, grant the minimum mailbox scopes possible, avoid granting delete/send authority unless needed, do not paste real tokens into chat or shell commands, and only install the porteden CLI from a source and version you can verify.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:175

Finding

Unpinned Third-Party CLI Receives Broad Mailbox Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 175–181
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

bash

brew install porteden/tap/porteden
go install porteden/cli/cmd/porteden@latest

Technical Analysis

The Skill instructs users or agents to install the porteden executable from external package sources. The Homebrew installation uses a third-party tap, while the Go installation explicitly retrieves the mutable @latest version.

Neither installation method pins an audited version, immutable commit, cryptographic checksum, or trusted signature. The document also does not provide a procedure for verifying the package's provenance. This creates a supply-chain risk because the executable installed at a later date may differ from the version originally reviewed.

This dependency is particularly sensitive because it is subsequently entrusted with OAuth or API credentials and can read, search, send, forward, modify, and delete email. The audit found no evidence that the current package is malicious; the vulnerability is the absence of controls ensuring that the downloaded executable remains trustworthy.

Attack Path

1. An attacker compromises the third-party package source, release workflow, repository, maintainer account, or distribution infrastructure.
2. The attacker publishes a modified package under the expected package name or replaces the release selected by @latest.
3. A user or agent follows the Skill instructions and installs the compromised executable.
4. The user authenticates the executable to a Gmail, Outlook, or Exchange mailbox.
5. The compromised executable captures credentials, reads mailbox contents, sends unauthorized messages, or deletes or modifies email.
6. Sensitive data can be transmitted using the network access already expected by the email client.

Impact Assessment

Successful exploitation could provide access to all email data an ...[truncated 643 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed semantic version or, preferably, an immutable commit identifier rather than @latest.
• Publish expected SHA-256 or stronger checksums and verify them before installation.
• Require cryptographically signed releases and document how users must verify signatures.
• Identify the canonical source repository, package namespace, maintainer, and distribution domains.
• Prefer a trusted package registry over an undocumented third-party tap where possible.
• Generate and retain a software bill of materials for reviewed releases.
• Apply the minimum OAuth scopes required for each operation and avoid granting write or delete access when only reading is needed.
• Run the CLI in a restricted environment with limited filesystem access and outbound network access constrained to documented service endpoints.
• Establish a dependency-update review process rather than automatically accepting new releases.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:190

Finding

Authentication Token Accepted Through a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 190
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

bash

porteden auth login --token [TOKEN_VALUE]

The placeholder above is an English representation of the configuration-value placeholder used in the audited command.

Technical Analysis

The documented authentication flow places an API token directly in a command-line argument. Real secrets supplied this way may be exposed through:

• Shell command-history files.
• Process listings and process-inspection interfaces.
• Terminal scrollback and session recording.
• Agent transcripts, command logs, and observability systems.
• Debug output, crash reports, or execution telemetry.
• Copy-and-paste buffers and automation logs.

Although the Skill also documents an environment-variable option and system-keychain storage, it does not warn users against placing actual tokens in command lines. Environment variables can also leak through process environments and diagnostic tooling, so an interactive secret prompt or keychain-based provisioning is preferable.

Attack Path

1. A user or agent replaces the documented placeholder with a valid mailbox API token.
2. The command is executed in an interactive shell, automated agent, CI environment, or monitored terminal.
3. The complete command is retained in shell history, an agent transcript, telemetry, or process metadata.
4. Another local user, administrator, log reader, compromised process, or party with transcript access retrieves the token.
5. The attacker submits the token to the supported API or CLI.
6. The attacker performs mailbox operations permitted by the token until it expires or is revoked.

Impact Assessment

Exposure can grant unauthorized mailbox access within the token's assigned scopes. Potential effects include reading sensitive email, obtaining attachments, sending messages as the victim, mo ...[truncated 278 chars]

Remediation

View remediation

Remediation Suggestions

• Remove examples that accept secrets directly through command-line arguments.
• Use an interactive prompt with terminal echo disabled.
• Support reading the token from standard input or a protected file descriptor without recording it in command history.
• Prefer browser-based OAuth with authorization-code and PKCE protections.
• Store resulting credentials in the operating system keychain with access restricted to the intended application and user.
• If environment variables must be supported, clearly document their exposure risks and discourage their use in shared or observable environments.
• Ensure the CLI redacts tokens from logs, errors, telemetry, process titles, and diagnostic output.
• Use short-lived, narrowly scoped tokens and provide straightforward revocation and rotation procedures.
• Warn users never to paste real credentials into agent conversations, scripts, issue reports, or command examples.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to authenticate via API token and environment variables, and later shows direct token usage and PE_API_KEY examples, but it does not prominently warn against exposing secrets in prompts, logs, shell history, screenshots, or shared terminals. In an agent context, this is dangerous because credentials may be copied into conversations or command lines and then persist in transcripts, history, or other tooling surfaces, enabling account compromise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill's trigger/scope language includes broad, everyday phrases such as messaging, notification pushing, communication integration, and team/automation workflow usage, which can cause the agent to invoke this skill outside the user's precise intent. In a skill with read/exec capability and access to email actions like send, reply, forward, delete, and modify, overbroad invocation raises the risk of unintended access to mailbox contents or accidental outbound actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description at L003/L010 limits the skill to Gmail and Outlook, while the overview explicitly states support for Gmail, Outlook, and Exchange. That is a semantic mismatch between the declared scope and the documented behavior of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill's purpose is managing email across providers, where accessing mail services is expected. However, instructing the agent to perform generic network diagnostics and broader connectivity troubleshooting goes beyond the core email-management capability described in the manifest and introduces an unrelated operational capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.