Security audit
Security checks for vulnerabilities and agentic risk
This skill is a legitimate Japanese business email drafting aid, but it automatically stores and reuses personal signature details in a local database with broad activation and limited consent controls.
Install only if you are comfortable with the skill saving your business signature details locally for reuse. Use a narrow, intentional invocation, avoid including sensitive contact fields casually, review stored signature updates before relying on generated emails, and delete fields with the documented rm flow when no longer needed.
The skill description presents itself primarily as a business email generator with cross-platform identity linkage, while the actual behavior centers on local signature processing and persistence. This mismatch can mislead users and reviewers about data handling, causing them to disclose personal information without understanding that it will be stored and reused.
The skill description says it persistently links multi-platform user IDs to signature storage, but it does not provide a prominent user warning or consent mechanism for this personal-data handling. This is dangerous because it involves persistent storage and cross-context identity correlation across messaging platforms, creating privacy, profiling, and compliance risks.
Referenced artifact was not completely inspected
- agentは**現在の 'SKILL.md' ファイルを一切変更・編集・上書き・更新しない**。
The activation trigger is described as broad terms like 'メール' or 'keigo mail', which can easily appear in ordinary conversation. In a chat environment, that raises the chance of unintended skill invocation, causing the skill to process messages that were not meant to persist data or generate business emails.
The README states that signature details, including phone numbers and email addresses, are persistently recorded from chat inputs for future reuse. Persisting personally identifiable information from free-form messages creates privacy risk, possible overcollection, and unauthorized reuse if users are not given explicit consent, visibility, retention limits, and deletion controls.
These instructions tell the skill to parse plain-language messages for company, mobile number, and email, then update a persistent database. Free-form extraction into long-lived storage increases the chance of storing incorrect, excessive, or sensitive data and can enable silent profile modification if a message is ambiguous or spoofed.
The English activation text repeats the same broad-trigger design without clarifying boundaries, so normal conversation containing 'mail' or related wording may activate the skill unexpectedly. Because the skill can read inputs for signature extraction and template use, accidental invocation has privacy and integrity consequences beyond simple misfires.
The English section explicitly says the skill records user signature information from chat and reuses it later, confirming persistent storage of personal data as a product feature. Without strict consent, least-privilege access, and lifecycle controls, this can expose users to privacy leakage and cross-session misuse.
The example instructs storing and updating mobile and email data from conversational messages in persistent storage, which normalizes sensitive-data handling through informal text commands. This is dangerous because accidental phrasing, impersonation, or parsing errors could alter persistent identity data and cause privacy or integrity issues in later generated emails.
The skill instructs the agent to invoke a local Python script via shell-like execution but does not declare any explicit tool scope or allowed-tools restrictions. This increases the risk of unintended command execution paths or permission creep, especially because the skill strongly directs tool usage while lacking sandbox boundaries in metadata.
The manifest lists "メール" as a standalone trigger, which is a very generic everyday term rather than a narrowly scoped invocation phrase. Because no exclusion conditions or narrower context are provided, this could cause unintended activation for many ordinary email-related conversations.
The instructions define the assistant as a Japanese business email generator and require keigo responses, effectively forcing a specific language/locale behavior. There is no indication that the user can choose another language or explicitly opt into this locale constraint.
The skill requires echoing changed signature fields back into the output after a write, which may expose newly stored personal data such as names, phone numbers, or addresses in visible conversation content. This creates a confidentiality risk, especially in shared chats, logs, or integrations where outputs are retained or viewable by others.
The entire template is written as a fixed Japanese outreach message, with no indication that language should be selected based on user preference or recipient locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
This skill stores persistent user identifiers and business-signature data in a local SQLite database, which goes beyond simple email text generation and creates a privacy/security exposure. In the context of a mail-generation skill, retaining cross-platform identity-linked contact details increases the blast radius of compromise and creates a surveillance-like data store without clear minimization or access controls.
The code writes signature and identity data to local storage without any visible consent, disclosure, or warning mechanism. Because the skill description explicitly mentions linking persistent signature storage to user IDs across messaging platforms, the lack of transparent notice and controls makes this more dangerous: users may reasonably expect ephemeral email generation, not silent long-term retention of personal/business contact data.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
This skill is provided as-is for personal and internal company use.
The generated emails are AI-assisted drafts only. Users are fully responsible for reviewing, modifying, and ensuring the accuracy, appropriateness, and legal compliance of any email before sending.
The author is not liable for any consequences arising from the use of emails generated by this skill, including but not limited to business misunderstandings, legal disputes, or reputational damage.
---
The entire template is written in Japanese and provides no indication that language should match the recipient's preference or that alternative locales are available. Under the policy criteria, forcing a specific language without user opt-in is a natural-language locale violation.
Beyond generating or formatting business email signatures, the code actively modifies OS-level permissions with chmod(0o700). That is a system-administration capability rather than an obvious requirement of producing keigo emails, and the manifest does not mention filesystem permission management.
At L348-L349 the code computes changed_fields from the unpruned merged dictionary, and only later prunes rm-marked fields at L353-L354. The comment at L366 claims 'No actual changes after pruning,' but the branch condition is based on pre-pruning changes, so the documentation misstates what the code is checking.
No suspicious patterns detected.