apple-mail
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
sqlite3to query the Apple Mail 'Envelope Index' database andfindto locate email body files (.emlx) and attachments on the local filesystem. These operations are scoped to the user's$HOME/Library/Maildirectory. - [DATA_EXPOSURE]: The skill facilitates access to sensitive email data (sender, body, attachments). However, this is the explicit purpose of the skill, and the execution is restricted to the local environment without any network exfiltration patterns. The shell script properly escapes single quotes in search filters to prevent SQL injection during database queries.
- [DYNAMIC_EXECUTION]: The script uses standard command-line tools (
dateorgdate) for timestamp conversion andtail/headfor parsing the Apple-specific.emlxfile format, which contains metadata before the raw RFC822 content.
Audit Metadata