agently-mail

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to extract and display raw authorization URLs and download URLs verbatim (in code blocks) and to handle confirmation tokens (ctk_xxx), which forces the LLM to include potentially sensitive tokens/URLs in its output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能在必需运行流程中通过 agently-cli message +read / message +search / message +watch 读取并处理用户邮箱中的邮件正文与字段（主题、发件人名称、附件名、body等），而这些内容被明确视为外部不可信文本并会被 LLM 摄入分析。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime installation/update via "npx skills add https://agent.qq.com --skill -g -y", which fetches and installs remote skill code from https://agent.qq.com that would be executed/loaded by the agent, so this URL is a runtime external dependency that can control agent behavior.