mailbox

SUSPICIOUS: the stated purpose is coherent for an email-management skill, but the reviewed file is mostly an installer/dispatcher that asks the agent to load a separate third-party skill and optionally a separate npm CLI. Because the actual mailbox logic, credential handling, and network endpoints are not present here, the trust chain and data flows cannot be fully verified.

The analyzed components describe legitimate utilities for bulk unsubscribe workflows and binary packaging, but they intrinsically enable automated network activity and browser navigation driven by input data. Critical security controls should be verified (input validation, explicit user consent for bulk actions, rate limiting, use of secure SMTP configurations, and integrity checks for packaged binaries). Absent concrete code, the risk is moderate and primarily operational/privacy-oriented rather than clearly malicious. Obtain and review the actual unsubscribe.mjs and build scripts to verify safeguards and prevent abuse.

SUSPICIOUS: the skill’s capabilities largely match its email-management purpose, but it installs and trusts a personal-publisher CLI that handles raw mailbox credentials and can perform real-world actions like sending or deleting email. No clear malicious routing or credential-harvesting endpoint is shown, so this is not confirmed malware, but it carries moderate supply-chain and credential-handling risk.

No direct evidence of covert malware (e.g., backdoors, credential theft, or hidden exfiltration) is present in the shown fragment. However, the code clearly supports high-impact email mutation when confirm=true (cleanup.apply and mk) and optional external notification side effects via digest.run. The biggest security concern is whether omitted modules enforce strict authorization/scope controls for account_id/folder/refs and whether digest notifications safely handle message content. Review cleanup.apply/mk/digest.run and authorization boundaries to ensure confirm cannot be abused and that targeting cannot escape the caller’s permitted mailbox scope.