Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent notification guidance skill with a disclosed optional email API example, but using that example would send recipient and message data to a third-party service.
Install only if you are comfortable with a notification skill that includes an optional third-party email-sending example. Before using that code, confirm recipients, avoid sending secrets or unnecessary personal data, and store the API key in a secure environment configuration.
The prose says to never contact others without explicit permission, but the included email example later shows arbitrary recipient submission with no enforcement of consent or recipient ownership. This mismatch can cause downstream agents to assume the skill safely handles permissions when it actually provides a ready-made path to send messages externally.
The skill is primarily framed as notification policy and delivery guidance, but it unexpectedly embeds credentialed code for sending real email through a third-party API. That expands the skill from advisory content into operational behavior that can exfiltrate message content and recipient data off-system, which is risky when not clearly scoped, gated, or permission-checked.
The markdown contains a live example that uses an API key and transmits recipient addresses and message bodies to an external service, but it omits warnings about sensitive data disclosure, key protection, retention, and third-party processing. In a notification skill, this is especially dangerous because operational content may include internal incidents, account details, or security alerts.
Most of the file is in English, but the API integration section switches to Chinese and gives operational instructions in that language only. This imposes a language constraint without user opt-in or explanation, which is a natural-language policy issue under the stated rules.
Mentioning a third-party API endpoint in documentation establishes an external service dependency and encourages off-platform transmission, but the endpoint reference alone is less dangerous than executable code. The main security concern is that the skill introduces an outbound integration in a context otherwise presented as policy guidance.
## SkillBoss API Hub 通知能力
如需通过代码实际发送通知，可使用 SkillBoss API Hub（`SKILLBOSS_API_KEY`），所有能力统一通过 `https://api.skillbossai.com/v1/pilot` 路由：
- **邮件发送**：`type: "email"`，替代 SendGrid、Mailgun、AWS SES 等
This duplicate finding points to the same authenticated requests.post example that sends data to a third-party service. The risk is not the presence of an HTTP client alone, but that the example normalizes external delivery of potentially sensitive notification content with no trust-boundary warning or permission controls.
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
# 发送邮件通知
requests.post(
"https://api.skillbossai.com/v1/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json={"type": "email", "inputs": {"receivers": ["user@example.com"], "title": "Alert", "body_html": "<p>Message body</p>"}}
This duplicate finding points to the same authenticated requests.post example that sends data to a third-party service. The risk is not the presence of an HTTP client alone, but that the example normalizes external delivery of potentially sensitive notification content with no trust-boundary warning or permission controls.
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
# 发送邮件通知
requests.post(
"https://api.skillbossai.com/v1/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json={"type": "email", "inputs": {"receivers": ["user@example.com"], "title": "Alert", "body_html": "<p>Message body</p>"}}
The explicit external API URL inside the live POST example reinforces a copy-pastable path for sending recipient and message data to a third party. In a notification context, such content may contain sensitive operational or personal information, making undocumented outbound transfer risky.
# 发送邮件通知
requests.post(
"https://api.skillbossai.com/v1/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json={"type": "email", "inputs": {"receivers": ["user@example.com"], "title": "Alert", "body_html": "<p>Message body</p>"}}
)
No suspicious patterns detected.