Security audit

邮件

Security checks across malware telemetry and agentic risk

Overview

This is a real email-management skill, but it asks for high-impact mailbox access while using overly broad routing language and some unsafe credential guidance.

Review this before installing because it can read and change email in authenticated Gmail, Outlook, or Exchange accounts. Use a dedicated profile, prefer browser-based login, avoid pasting tokens into commands, confirm every send/reply/forward/delete/modify action, and revoke/logout when finished on shared machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill states that send/reply/forward/delete/modify operations require explicit user confirmation, but other sections promote bulk processing and workflow automation without a hard enforcement mechanism. In an agent context, this mismatch can cause autonomous execution of externally visible or destructive email actions, especially if the model follows broader automation framing instead of the safety caveat.

Intent-Code Divergence

Medium

Confidence: 78% confidence
Finding: The document inconsistently labels the skill as both EXEC-capable and pure Markdown, despite documenting command execution and declaring the exec tool. This ambiguity can cause host agents or reviewers to underestimate the skill's ability to run commands and access live mail data, weakening risk controls and trust decisions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation guidance is extremely broad, framing the skill as suitable for generic efficiency, automation, batch processing, and workflow optimization tasks. In agent routing systems, this can cause over-triggering of a high-privilege email skill for loosely related requests, increasing the chance of unnecessary mailbox access or unintended outbound actions.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The later classification again describes the skill in generic terms as a Markdown-driven agent capability rather than a narrowly scoped email operator. That broad framing increases accidental selection and may bypass stricter review expected for a command-executing, credential-using integration.

Credential Access

High

Category: Privilege Escalation
Content: 1. 安装 porteden CLI:`brew install porteden/tap/porteden` 2. 登录(三选一): - 浏览器登录(推荐):`porteden auth login` 打开浏览器,凭证存入系统 keyring - 直接 token:`porteden auth login --token <key>` 存入 keyring - 环境变量:设置 `PE_API_KEY`,CLI 自动使用,无需登录 3. 验证:`porteden auth status` 4. 设置默认 profile(可选):`export PE_PROFILE=work`,避免每次输入 `--profile`
Confidence: 72% confidence
Finding: The skill explicitly recommends `porteden auth login --token <key>` and environment-variable based API key usage in an agent context. Passing raw tokens on a command line can expose them to shell history, process listings, transcripts, or agent logs, creating a realistic secret leakage path even if the surrounding intent is legitimate.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.