Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Gmail-based job-search report generator with optional saving, and I found no hidden execution, exfiltration, or destructive behavior.
Install only if you are comfortable letting the agent search your authenticated Gmail for recent job-application and recruiter messages. Review the generated report before saving or sharing it, and only use the Google Docs option when you intentionally want that data handled through Google Docs.
The activation phrases are broad enough to match normal conversation about job hunting, which can cause the skill to trigger unexpectedly and access Gmail data when the user did not intend to run an email-analysis workflow. In this context, accidental activation is more serious because the skill processes private mailbox content.
The skill is designed to search sent and inbox Gmail messages and summarize their contents, but it provides no user-facing privacy notice or consent reminder at activation time. Because it processes potentially sensitive employment, salary, recruiter, and contact information, the lack of a privacy warning materially increases the risk of unexpected exposure.
The skill’s documented behavior expands beyond reading Gmail and generating a report by introducing persistence to a local file and possible interaction with Google Docs. This scope expansion increases the chance of unintended data handling and retention for sensitive job-search communications, especially if users do not expect their email-derived report to be written elsewhere.
Adding optional Google Docs access is unnecessary for the stated Gmail-analysis task and creates an additional data sink for sensitive personal information. Even if framed as optional, it broadens privileges and increases exposure if invoked without clear consent and documented need.
No suspicious patterns detected.
