Security audit

邮件技能

Security checks for vulnerabilities and agentic risk

Overview

This SMTP email skill is mostly aligned with sending email, but it requests broad agent tools and lacks clear safeguards before transmitting recipients, message bodies, credentials, and attachments externally.

Review this skill before installing. Use it only in environments where the agent may send email, read attachment files, and use SMTP credentials. Confirm recipients, body, attachments, and sending account manually before any send, and prefer environment variables or a secrets manager over plaintext credential files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill documentation claims the capability is pure Markdown / natural-language driven, but the manifest elsewhere declares read, write, and exec tool access. This mismatch can cause users or orchestrators to underestimate the privilege level of the skill, increasing the chance that it is invoked in higher-trust contexts without appropriate review or sandboxing.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The document first narrows scope to SMTP sending only, then later advertises unrelated file handling, API integration, command execution, and information retrieval. This scope creep is dangerous because it obscures the real attack surface and may enable overly broad invocation or permission grants for a skill that appears narrowly focused.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation text says to use the skill whenever the user needs email-related functionality, which is overly broad for a skill with networked sending, file access, and possible command execution. Broad trigger conditions increase the likelihood of accidental activation on ordinary email discussions or drafting tasks, potentially causing unintended transmission of message content, attachments, or credential-backed operations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes sending emails, attachments, and HTML content over third-party SMTP services but does not present a clear user warning about external transmission of potentially sensitive data. Without an explicit notice and confirmation boundary, users may unknowingly cause confidential content or local files to be sent off-host to unintended recipients or providers.

Static analysis

No suspicious patterns detected.