mailbox
Pass
Audited by Gen Agent Trust Hub on Jun 1, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No malicious behavioral overrides, safety filter bypasses, or instructions to ignore constraints were found in the skill markdown or metadata.
- [DATA_EXFILTRATION]: Email credentials and metadata are stored locally in user-controlled directories (~/.config/mailbox and ~/.local/share/mailbox). Network communication is limited to configured IMAP/SMTP servers, and no evidence of unauthorized data transmission was detected.
- [EXTERNAL_DOWNLOADS]: The project uses standard, reputable Node.js libraries such as imapflow, nodemailer, and sql.js. All external references point to legitimate package registries or the author's own repository.
- [COMMAND_EXECUTION]: The skill invokes system commands for documented lifecycle management (e.g., systemctl and launchctl for daemon persistence) and browser integration in helper scripts. No arbitrary or high-risk command execution was observed.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or API keys were found in the source code. The tool enforces the use of local authentication files and environment variables for secret management.
- [REMOTE_CODE_EXECUTION]: The skill does not perform unsafe dynamic evaluation of strings or execution of remote scripts via curl-to-shell patterns.
Audit Metadata