Security Audit

agentmail-to/agentmail-skills:agentmail-toolkit

github.com/agentmail-to/agentmail-skills

AI SkillCommit 0f99f45fbce2

TRUSTED

Scanned about 1 month ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

agentmail-to/agentmail-skills:agentmail-toolkit received a trust score of 78/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned Dependencies in Installation Instructions, Broad Email Capabilities Pose Data Exfiltration and Abuse Risks.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 27, 2026 (commit 0f99f45f). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

78%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Network Access

1 finding

Dynamic Code

1 finding

Security Findings2

Severity	Finding	Layer	Location
HIGH	Broad Email Capabilities Pose Data Exfiltration and Abuse Risks The `agentmail-toolkit` provides a comprehensive set of email management tools, including `send_message`, `reply_to_message`, `delete_inbox`, and `get_attachment`. While these are core functionalities for an email agent, they also represent significant capabilities that, if misused by a compromised AI agent (e.g., via prompt injection), could lead to severe consequences. An attacker could instruct the agent to send unauthorized emails (spam, phishing), delete critical inboxes, or exfiltrate sensitive data by downloading attachments and then using other agent tools (if available) to transmit them externally. Implement robust input validation and output filtering for all agent prompts and responses. Consider implementing human-in-the-loop approval for sensitive actions like sending emails or deleting inboxes. If possible, explore fine-grained access control mechanisms within the AgentMail API to restrict the agent's capabilities based on context or user permissions. Educate users about the potential risks of agent compromise and the importance of carefully crafting prompts.	Static	SKILL.md:80
MEDIUM	Unpinned Dependencies in Installation Instructions The installation instructions for both TypeScript/Node and Python use unpinned dependencies (`npm install agentmail-toolkit` and `pip install agentmail-toolkit`). This means the latest version of the package will always be installed, which could introduce breaking changes, unexpected behavior, or security vulnerabilities if a malicious update is published to the package registry (supply chain attack). Pin dependencies to specific versions or version ranges (e.g., `npm install agentmail-toolkit@1.0.0` or `pip install agentmail-toolkit==1.0.0`) to ensure consistent and predictable behavior and mitigate risks from unexpected updates.	Static	SKILL.md:13

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/72a01793848fd090.svg)](https://skillshield.io/report/72a01793848fd090)