apple-mail

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes sqlite3 to query the Apple Mail 'Envelope Index' database and find to locate email body files (.emlx) and attachments on the local filesystem. These operations are scoped to the user's $HOME/Library/Mail directory.
  • [DATA_EXPOSURE]: The skill facilitates access to sensitive email data (sender, body, attachments). However, this is the explicit purpose of the skill, and the execution is restricted to the local environment without any network exfiltration patterns. The shell script properly escapes single quotes in search filters to prevent SQL injection during database queries.
  • [DYNAMIC_EXECUTION]: The script uses standard command-line tools (date or gdate) for timestamp conversion and tail/head for parsing the Apple-specific .emlx file format, which contains metadata before the raw RFC822 content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:13 AM