Security audit

inbox-zero-warrior

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be an offline email-export triage tool, with privacy and review cautions but no evidence of hidden sending, unsubscribing, or account changes.

Use this only with email exports you are comfortable processing locally. Review all unsubscribe, delete/file, and reply suggestions before taking action, and avoid saving or displaying triage outputs in shared terminals or folders when the emails contain sensitive information.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises file-writing capability without declaring permissions, which weakens transparency and reviewability around what the skill can modify. In a skill that processes sensitive email exports, undeclared write behavior could lead to unexpected persistence of data, modification of local files, or creation of artifacts containing private email content.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documentation says the skill only analyzes exported email and should not perform actual sending/receiving, yet it also describes batch-unsubscribing from newsletters, which is an external account-affecting action. This mismatch can mislead users and reviewers about the operational scope of the skill and may cause unauthorized or unexpected changes to a user's subscriptions.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The docs are internally inconsistent about whether the skill is analysis-only or can take live actions. Security-sensitive ambiguity is dangerous because users may consent to a passive analysis workflow while the skill behavior implies active account modification such as unsubscribing or rule changes.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README promotes generating unsubscribe action lists and suggested email replies without explicitly warning users to review outputs before taking action. In an email-management skill, automated unsubscribe or reply suggestions can cause accidental loss of important communications, reputational harm, or unintended responses if users treat the output as safe to apply directly.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill processes exported email contents, which may include sensitive personal, financial, or business information, but it lacks a clear privacy and data-handling warning. Users are not informed how their email data is stored, retained, redacted, or protected, increasing the risk of accidental exposure or misuse of highly sensitive inbox data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Bulk unsubscribe is an account-impacting action, but the skill does not provide a sufficiently clear warning about the consequences, reversibility, or risk of unsubscribing from wanted communications. In the inbox-management context, users may over-trust automation and trigger broad subscription changes without informed review.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The urgent-items view prints a body preview for each email directly to stdout, which can expose sensitive email contents such as credentials, personal data, financial details, or internal business information to anyone with terminal access, logs, screen recordings, or shared console history. In an inbox-triage skill, this risk is more relevant because the tool is explicitly designed to process potentially sensitive communications and surfaces them in bulk without redaction or an explicit disclosure warning.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.