pst-mail-skills

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill is high-risk: it explicitly accesses a host-resident Outlook PST (including a full "extract_pst" dump), instructs the agent to avoid asking the user or searching the sandbox, and uses an outbound MCP client (configurable via env/flag), enabling straightforward unauthorized data exfiltration and redirection to arbitrary endpoints.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested because scripts/pst_client.py calls the remote MCP server and then returns result.content[0].text (which will contain PST email subject/body content authored by external correspondents) into the agent’s context via the tool result path.