Skip to content
Report library
Purpose / Other

Extension Email Skill Security Audit

What the author says it does (original text)

Support for sending service/transactional emails. Don't use this for sending marketing emails or verification emails.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
High risk

The example creates an unauthenticated email-sending endpoint

Source references: 4
What we found

The example declares the sending function public but performs no caller authentication, order-ownership check, or verification that the recipient belongs to the caller. The caller selects the recipient and controls the username and order reference inserted into the subject and body.

Why this matters

If copied into an application, anyone able to call the canister could send email to arbitrary addresses under the application's identity, enabling spam, phishing, or harassment while consuming email quota and harming domain reputation. Because the API treats the body as HTML, unescaped dynamic values could also insert deceptive markup.

The skill explicitly directs use of the email-sending function, while the example exposes a public wrapper whose caller supplies the recipient address, username, and order reference. No identity, order-ownership, or recipient-authorization check is visible. If deployed as shown, anyone able to call that endpoint could potentially send fabricated order confirmations to arbitrary addresses, creating spam, reputation, or cost risk. A user can ask the author for authentication, server-side order-to-recipient binding, rate limits, and removal of caller-controlled recipient/content fields.

SKILL.md:35In the instructionsOpen original file
  public func sendServiceEmail(    fromUsername : Text,    recipients : [Text],    subject : Text,    htmlBody : Text,  ) : async SendResult;};
Show 3 other places
SKILL.md:51In the instructionsOpen original file
actor {  public func sendOrderConfirmationEmail(recipientEmailAddress : Text, username : Text, orderReference : Text) : async () {    let result = await EmailClient.sendServiceEmail(      "no-reply",      [recipientEmailAddress],      "Order " # orderReference # " confirmed",      "Hello " # username # ",\nYour order " # orderReference # " has been confirmed. Your items will ship tomorrow.",    );    switch (result) {
SKILL.md:16In the instructionsOpen original file
This skill adds support for sending service and transactional emails from the backend canister. Use `sendServiceEmail` for order confirmations, notifications, and similar one-off emails.
SKILL.md:24In the instructionsOpen original file
- Use the sendServiceEmail function. - Each recipient is sent an individual email- It returns a SendResult which is #ok if the email is sent successfully otherwise #err(error) with the error text. 
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill is intended to send service or transactional email from a backend canister, and explicitly excludes marketing and verification email.

View source
SKILL.md:3In the instructionsOpen original file
name: extension-emaildescription: Support for sending service/transactional emails. Don't use this for sending marketing emails or verification emails.version: 0.2.0
SKILL.md:16In the instructionsOpen original file
This skill adds support for sending service and transactional emails from the backend canister. Use `sendServiceEmail` for order confirmations, notifications, and similar one-off emails.

The underlying email module accepts a sender username, recipient list, subject, and HTML body; it sends a separate message to each recipient.

View source
SKILL.md:25In the instructionsOpen original file
- Use the sendServiceEmail function. - Each recipient is sent an individual email- It returns a SendResult which is #ok if the email is sent successfully otherwise #err(error) with the error text. 
SKILL.md:35In the instructionsOpen original file
  public func sendServiceEmail(    fromUsername : Text,    recipients : [Text],    subject : Text,    htmlBody : Text,  ) : async SendResult;};

The example exposes a public sending function and directly uses caller-provided recipient address, username, and order reference in the outgoing email.

View source
SKILL.md:51In the instructionsOpen original file
actor {  public func sendOrderConfirmationEmail(recipientEmailAddress : Text, username : Text, orderReference : Text) : async () {    let result = await EmailClient.sendServiceEmail(      "no-reply",      [recipientEmailAddress],      "Order " # orderReference # " confirmed",      "Hello " # username # ",\nYour order " # orderReference # " has been confirmed. Your items will ship tomorrow.",    );
Start here · InstructionsSKILL.md
extension-email
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
# Email — Service/TransactionalService/transactional email extension for [Caffeine AI](https://caffeine.ai?utm_source=caffeine-skill&utm_medium=referral).
Lines read
67
File checksum (to compare versions)
025f11c81320e531f2049b31d9126ed2ccd77186d0a288e2c4c9189af8176607