Trust Assessment
outlook-email received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Data Exfiltration via File Upload.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Data Exfiltration via File Upload The skill documentation explicitly shows the capability to send the content of a local file as an email body using `outlook send --body-file <path>`. If an AI agent is prompted with a malicious file path (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, or sensitive application configuration files), it could be coerced into exfiltrating sensitive data from the system where the skill is executed. This is a direct capability documented by the skill, presenting a clear vector for data leakage if misused. Implement strict validation and allow-listing for file paths provided to the `--body-file` argument within the `outlook` script. Consider restricting access to sensitive directories or requiring explicit user confirmation for sending file contents. If the skill runs in a sandboxed environment, ensure the sandbox prevents access to sensitive system files. | LLM | SKILL.md:49 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/abhiramee08b021/outlook-email/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/4d66106429fd6516)
Powered by SkillShield