Zero‑Exposure SMTP Mail Sender (MGC Secure Edition)

• Outcome: Review
• Latest audit: Aug 20, 2026 · 2:40 AM UTC
• Version: 2.1.1

Overview

This skill is purpose-aligned with sending email, but it under-describes that it provides runnable automation using stored credentials and outbound SMTP.

Review this carefully before installing. It is not just passive documentation: it provides a working pattern for stored script execution that can send real email using persisted SMTP credentials. Only use it with credentials you are comfortable storing in MGC, require explicit review before every mgc_run send, and consider adding allowlists, dry-run mode, and confirmation logging before operational use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill embeds and instructs use of code with network and file-write capabilities, but declares no permissions or equivalent capability boundaries. That mismatch is dangerous because reviewers or agents may treat the skill as low-risk documentation while it actually enables outbound email sending, local token access, and writing result files.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The document claims to be non-executable documentation, yet includes a complete working Python script plus exact storage and execution steps via mgc_save and mgc_run. This is dangerous because it obscures that the skill directly enables automated outbound communication and credential use under a misleading safety framing.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill states that AI never sees script content, but the full script is included inline in the skill file itself. This contradiction weakens the trust model and can mislead users about exposure boundaries, especially because the script contains logic for credential retrieval and outbound email transmission.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The file says it does not provide automated email sending, but then gives exact instructions and code to automate sending through mgc_run. This inconsistency is dangerous because it downplays the operational capability and may bypass scrutiny for a workflow that can send arbitrary outbound messages.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The script directly reads the local MGC bearer token from disk and then uses it to access the sensitive-data API. This expands the script's effective authority beyond narrowly sending email, because possession of that token may permit access to other secrets depending on MGC policy.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The README labels the skill as 'only a documentation skill' while also providing concrete operational steps and runnable example code to execute an email-sending script via `mgc_run`. This mismatch can mislead reviewers, policy engines, or users about the skill's real capabilities, reducing scrutiny around a feature that can trigger outbound communication and use stored secrets indirectly.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README claims the AI never sees the email body when stored in MGC, but the main example passes `--body "Hello"` directly in the `mgc_run` arguments, meaning the AI constructing the call would necessarily see the message content. This inconsistency undermines the stated privacy guarantee and may cause users to expose sensitive email content under the false assumption that the workflow is zero-exposure.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script silently retrieves SMTP credentials from MGC's sensitive-data API without any explicit runtime disclosure to the user. In an agent-driven environment, hidden secret access is risky because users may not realize the script is consuming stored credentials and exercising privileged local access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script transmits recipient addresses and message content over SMTP, but it provides no user-visible warning or confirmation at send time. In agent workflows, this can lead to unintended external disclosure of sensitive information if a send is triggered with the wrong content or recipient.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.