zoho-mail-health-check
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses email metadata including subjects and sender addresses to generate health reports. It requires sensitive API credentials such as Client Secrets and Refresh Tokens; however, it correctly directs users to manage these through environment variables rather than hardcoding them within the skill files.
- [EXTERNAL_DOWNLOADS]: The fallback script utilizes the
requestslibrary to interact with well-known Zoho service domains (accounts.zoho.comandmail.zoho.com). These network operations are strictly limited to official service endpoints required for the skill's functionality. - [COMMAND_EXECUTION]: If the primary MCP tools are unavailable, the skill executes a locally provided Python script via the shell. This script is part of the skill's own reference documentation and performs standard API interactions.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted content from external email subjects and senders without explicit boundary markers. While this creates a potential vector for malicious content to be included in reports, the risk is inherent to mail-processing tasks and the skill's capabilities are scoped to health checking.
Audit Metadata