{"data":{"skill":{"slug":"caopulan-email-notify","name":"email-notify","icon":"📦","repo":"https://github.com/caopulan/Notification-Skill/tree/main/email-notify","status":"approved","author":"caopulan","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"0591b896-2d80-48f3-9ed2-29fca9db42f5","skill_id":"46749970-16c9-4c01-83ea-f1ce73a47891","version":7,"content_hash":"e6a3487e6e1ce560a47f3771a6ae92be","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The skill legitimately sends SMTP messages and reads environment variables for SMTP configuration, including credentials. Most SKILL.md shell/backtick detections are Markdown or setup examples, but storing SMTP credentials in shell startup files is a real concern. No prompt injection text or unauthorized exfiltration intent was found beyond the configured email notification behavior.","remediation":[{"issue":"Plaintext SMTP credential guidance in shell startup files","severity":"high","suggestion":"Recommend provider app passwords, a secret manager, or per-session environment injection instead of storing CODEX_EMAIL_PASSWORD in ~/.bashrc or ~/.zshrc."},{"issue":"Email summaries may contain sensitive data","severity":"medium","suggestion":"Add stronger guidance to redact secrets, tokens, customer data, and private project details before sending notifications."},{"issue":"SMTP recipients and sender are trusted from environment variables","severity":"medium","suggestion":"Document that users should restrict recipients and use a dedicated notification mailbox with least privilege."},{"issue":"The workflow runs a Python helper from a shell command","severity":"medium","suggestion":"Keep command arguments quoted, avoid untrusted multiline content, and document dry-run verification before first use."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"scripts/send_email_notification.py","line_end":5,"line_start":5},{"file":"scripts/send_email_notification.py","line_end":89,"line_start":89},{"file":"scripts/send_email_notification.py","line_end":103,"line_start":103},{"file":"scripts/send_email_notification.py","line_end":104,"line_start":104},{"file":"scripts/send_email_notification.py","line_end":105,"line_start":105},{"file":"scripts/send_email_notification.py","line_end":106,"line_start":106},{"file":"scripts/send_email_notification.py","line_end":107,"line_start":107},{"file":"scripts/send_email_notification.py","line_end":108,"line_start":108},{"file":"scripts/send_email_notification.py","line_end":113,"line_start":113},{"file":"scripts/send_email_notification.py","line_end":114,"line_start":114},{"file":"scripts/send_email_notification.py","line_end":116,"line_start":116},{"file":"scripts/send_email_notification.py","line_end":119,"line_start":119},{"file":"scripts/send_email_notification.py","line_end":122,"line_start":122},{"file":"scripts/send_email_notification.py","line_end":125,"line_start":125},{"file":"scripts/send_email_notification.py","line_end":130,"line_start":130},{"file":"scripts/send_email_notification.py","line_end":132,"line_start":132},{"file":"scripts/send_email_notification.py","line_end":145,"line_start":145},{"file":"scripts/send_email_notification.py","line_end":173,"line_start":173},{"file":"scripts/send_email_notification.py","line_end":178,"line_start":178},{"file":"scripts/send_email_notification.py","line_end":179,"line_start":179},{"file":"scripts/send_email_notification.py","line_end":182,"line_start":182},{"file":"scripts/send_email_notification.py","line_end":190,"line_start":190},{"file":"scripts/send_email_notification.py","line_end":191,"line_start":191},{"file":"scripts/send_email_notification.py","line_end":194,"line_start":194},{"file":"scripts/send_email_notification.py","line_end":200,"line_start":200},{"file":"scripts/send_email_notification.py","line_end":201,"line_start":201},{"file":"scripts/send_email_notification.py","line_end":203,"line_start":203},{"file":"scripts/send_email_notification.py","line_end":5,"line_start":5},{"file":"scripts/send_email_notification.py","line_end":190,"line_start":190},{"file":"scripts/send_email_notification.py","line_end":194,"line_start":194},{"file":"scripts/send_email_notification.py","line_end":203,"line_start":203},{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31}]},{"factor":"env_access","evidence":[{"file":"scripts/send_email_notification.py","line_end":71,"line_start":71},{"file":"scripts/send_email_notification.py","line_end":102,"line_start":102},{"file":"scripts/send_email_notification.py","line_end":103,"line_start":103},{"file":"scripts/send_email_notification.py","line_end":104,"line_start":104},{"file":"scripts/send_email_notification.py","line_end":105,"line_start":105},{"file":"scripts/send_email_notification.py","line_end":106,"line_start":106},{"file":"scripts/send_email_notification.py","line_end":107,"line_start":107},{"file":"scripts/send_email_notification.py","line_end":108,"line_start":108}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":28,"line_start":18},{"file":"SKILL.md","line_end":30,"line_start":28},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":51,"line_start":45},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":66,"line_start":62}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":57,"line_start":57}]}],"critical_findings":[],"high_findings":[{"title":"Hidden file in home directory","locations":[{"file":"SKILL.md","line_end":16,"line_start":16}],"confidence":0.86,"description":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The setup instructions direct users to place notification settings in shell startup dotfiles. This can persist plaintext SMTP credentials in hidden home-directory files."},{"title":"Hidden file access","locations":[{"file":"SKILL.md","line_end":16,"line_start":16}],"confidence":0.86,"description":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The setup instructions direct users to place notification settings in shell startup dotfiles. This can persist plaintext SMTP credentials in hidden home-directory files."},{"title":"Plaintext SMTP Credential Storage Guidance","locations":[{"file":"SKILL.md","line_end":27,"line_start":16}],"confidence":0.9,"description":"The setup instructions tell users to place CODEX_EMAIL_PASSWORD in shell startup files. This can persist SMTP credentials in plaintext dotfiles.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"SKILL.md explicitly shows CODEX_EMAIL_PASSWORD in the shell profile export block. The storage risk follows directly from the documented setup."}],"medium_findings":[{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":5,"line_start":5}],"confidence":0.84,"description":"import smtplib","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":89,"line_start":89}],"confidence":0.84,"description":"description=\"Send an SMTP email notification for a Codex task.\"","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":103,"line_start":103}],"confidence":0.84,"description":"smtp_host = os.environ.get(\"CODEX_EMAIL_SMTP_HOST\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":104,"line_start":104}],"confidence":0.84,"description":"smtp_port_raw = os.environ.get(\"CODEX_EMAIL_SMTP_PORT\", \"587\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":105,"line_start":105}],"confidence":0.84,"description":"smtp_user = os.environ.get(\"CODEX_EMAIL_USERNAME\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":106,"line_start":106}],"confidence":0.84,"description":"smtp_password = os.environ.get(\"CODEX_EMAIL_PASSWORD\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":107,"line_start":107}],"confidence":0.84,"description":"smtp_from = os.environ.get(\"CODEX_EMAIL_FROM\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":108,"line_start":108}],"confidence":0.84,"description":"smtp_to_raw = os.environ.get(\"CODEX_EMAIL_TO\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":145,"line_start":145}],"confidence":0.84,"description":"recipients = _split_recipients(smtp_to_raw)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":173,"line_start":173}],"confidence":0.84,"description":"msg[\"From\"] = smtp_from","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":190,"line_start":190}],"confidence":0.92,"description":"client: smtplib.SMTP = smtplib.SMTP_SSL(","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line participates directly in SMTP connection, authentication, or delivery. The skill can send task data to an external mail server."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":191,"line_start":191}],"confidence":0.92,"description":"smtp_host, smtp_port, timeout=args.timeout","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line participates directly in SMTP connection, authentication, or delivery. The skill can send task data to an external mail server."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":194,"line_start":194}],"confidence":0.92,"description":"client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line participates directly in SMTP connection, authentication, or delivery. The skill can send task data to an external mail server."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":200,"line_start":200}],"confidence":0.84,"description":"if smtp_user:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":201,"line_start":201}],"confidence":0.92,"description":"client.login(smtp_user, smtp_password)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"This line participates directly in SMTP connection, authentication, or delivery. The skill can send task data to an external mail server."},{"title":"Python email libraries","locations":[{"file":"scripts/send_email_notification.py","line_end":5,"line_start":5}],"confidence":0.9,"description":"import smtplib","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The script imports and uses smtplib to create SMTP or SMTPS clients. That is direct network email functionality."},{"title":"Python email libraries","locations":[{"file":"scripts/send_email_notification.py","line_end":190,"line_start":190}],"confidence":0.9,"description":"client: smtplib.SMTP = smtplib.SMTP_SSL(","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The script imports and uses smtplib to create SMTP or SMTPS clients. That is direct network email functionality."},{"title":"Python email libraries","locations":[{"file":"scripts/send_email_notification.py","line_end":194,"line_start":194}],"confidence":0.9,"description":"client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The script imports and uses smtplib to create SMTP or SMTPS clients. That is direct network email functionality."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":62,"line_start":56}],"confidence":0.72,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The workflow includes a shell command that runs the Python notification helper. The command is expected, but it executes local code and passes user-controlled task text as arguments."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":0.86,"description":"description: Send SMTP email notifications after Codex completes a task. Use when one Codex or Claud","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":10,"line_start":10}],"confidence":0.86,"description":"Send an email notification after each Codex task. Use the helper script to resolve the project name ","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":20,"line_start":20}],"confidence":0.86,"description":"export CODEX_EMAIL_SMTP_HOST=\"smtp.example.com\"","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":21,"line_start":21}],"confidence":0.86,"description":"export CODEX_EMAIL_SMTP_PORT=\"587\"","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":30,"line_start":30}],"confidence":0.86,"description":"If your SMTP server does not require auth, leave `CODEX_EMAIL_USERNAME` and `CODEX_EMAIL_PASSWORD` u","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":31,"line_start":31}],"confidence":0.86,"description":"Set `CODEX_EMAIL_USE_SSL` to `true` for SMTPS (typically port 465) and `CODEX_EMAIL_USE_TLS` to `tru","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path."}],"low_findings":[{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":71,"line_start":71}],"confidence":0.7,"description":"value = os.environ.get(name)","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The helper reads named environment values for TLS and SSL options. Access is limited to configured names, but environment access is real."},{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":102,"line_start":102}],"confidence":0.82,"description":"machine_name = os.environ.get(\"CODEX_MACHINE_NAME\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details."},{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":103,"line_start":103}],"confidence":0.82,"description":"smtp_host = os.environ.get(\"CODEX_EMAIL_SMTP_HOST\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details."},{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":104,"line_start":104}],"confidence":0.82,"description":"smtp_port_raw = os.environ.get(\"CODEX_EMAIL_SMTP_PORT\", \"587\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details."},{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":105,"line_start":105}],"confidence":0.82,"description":"smtp_user = os.environ.get(\"CODEX_EMAIL_USERNAME\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details."},{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":106,"line_start":106}],"confidence":0.88,"description":"smtp_password = os.environ.get(\"CODEX_EMAIL_PASSWORD\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads CODEX_EMAIL_PASSWORD from the environment for SMTP login. This is expected, but it gives the skill process access to an email credential."},{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":107,"line_start":107}],"confidence":0.82,"description":"smtp_from = os.environ.get(\"CODEX_EMAIL_FROM\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details."},{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":108,"line_start":108}],"confidence":0.82,"description":"smtp_to_raw = os.environ.get(\"CODEX_EMAIL_TO\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details."}],"dangerous_patterns":[],"files_scanned":2,"total_lines":282,"audit_model":"codex","audited_at":"2026-07-05T07:17:42.697+00:00","created_at":"2026-07-05T08:32:33.113058+00:00","static_findings":[{"id":"network:scripts/send_email_notification.py:5:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"import smtplib","category":"network","line_end":5,"severity":"medium","line_start":5},{"id":"network:scripts/send_email_notification.py:89:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"description=\"Send an SMTP email notification for a Codex task.\"","category":"network","line_end":89,"severity":"medium","line_start":89},{"id":"network:scripts/send_email_notification.py:103:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_host = os.environ.get(\"CODEX_EMAIL_SMTP_HOST\")","category":"network","line_end":103,"severity":"medium","line_start":103},{"id":"network:scripts/send_email_notification.py:104:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_port_raw = os.environ.get(\"CODEX_EMAIL_SMTP_PORT\", \"587\")","category":"network","line_end":104,"severity":"medium","line_start":104},{"id":"network:scripts/send_email_notification.py:105:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_user = os.environ.get(\"CODEX_EMAIL_USERNAME\")","category":"network","line_end":105,"severity":"medium","line_start":105},{"id":"network:scripts/send_email_notification.py:106:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_password = os.environ.get(\"CODEX_EMAIL_PASSWORD\")","category":"network","line_end":106,"severity":"medium","line_start":106},{"id":"network:scripts/send_email_notification.py:107:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_from = os.environ.get(\"CODEX_EMAIL_FROM\")","category":"network","line_end":107,"severity":"medium","line_start":107},{"id":"network:scripts/send_email_notification.py:108:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_to_raw = os.environ.get(\"CODEX_EMAIL_TO\")","category":"network","line_end":108,"severity":"medium","line_start":108},{"id":"network:scripts/send_email_notification.py:113:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if not smtp_host:","category":"network","line_end":113,"severity":"medium","line_start":113},{"id":"network:scripts/send_email_notification.py:114:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"sys.stderr.write(\"Missing CODEX_EMAIL_SMTP_HOST.\\n\")","category":"network","line_end":114,"severity":"medium","line_start":114},{"id":"network:scripts/send_email_notification.py:116:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if not smtp_from:","category":"network","line_end":116,"severity":"medium","line_start":116},{"id":"network:scripts/send_email_notification.py:119:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if not smtp_to_raw:","category":"network","line_end":119,"severity":"medium","line_start":119},{"id":"network:scripts/send_email_notification.py:122:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if smtp_user and not smtp_password:","category":"network","line_end":122,"severity":"medium","line_start":122},{"id":"network:scripts/send_email_notification.py:125:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if smtp_password and not smtp_user:","category":"network","line_end":125,"severity":"medium","line_start":125},{"id":"network:scripts/send_email_notification.py:130:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_port = int(smtp_port_raw)","category":"network","line_end":130,"severity":"medium","line_start":130},{"id":"network:scripts/send_email_notification.py:132:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"sys.stderr.write(\"CODEX_EMAIL_SMTP_PORT must be an integer.\\n\")","category":"network","line_end":132,"severity":"medium","line_start":132},{"id":"network:scripts/send_email_notification.py:145:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"recipients = _split_recipients(smtp_to_raw)","category":"network","line_end":145,"severity":"medium","line_start":145},{"id":"network:scripts/send_email_notification.py:173:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"msg[\"From\"] = smtp_from","category":"network","line_end":173,"severity":"medium","line_start":173},{"id":"network:scripts/send_email_notification.py:178:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"print(\"SMTP host:\", smtp_host)","category":"network","line_end":178,"severity":"medium","line_start":178},{"id":"network:scripts/send_email_notification.py:179:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"print(\"SMTP port:\", smtp_port)","category":"network","line_end":179,"severity":"medium","line_start":179},{"id":"network:scripts/send_email_notification.py:182:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"print(\"from:\", smtp_from)","category":"network","line_end":182,"severity":"medium","line_start":182},{"id":"network:scripts/send_email_notification.py:190:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"client: smtplib.SMTP = smtplib.SMTP_SSL(","category":"network","line_end":190,"severity":"medium","line_start":190},{"id":"network:scripts/send_email_notification.py:191:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_host, smtp_port, timeout=args.timeout","category":"network","line_end":191,"severity":"medium","line_start":191},{"id":"network:scripts/send_email_notification.py:194:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)","category":"network","line_end":194,"severity":"medium","line_start":194},{"id":"network:scripts/send_email_notification.py:200:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if smtp_user:","category":"network","line_end":200,"severity":"medium","line_start":200},{"id":"network:scripts/send_email_notification.py:201:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"client.login(smtp_user, smtp_password)","category":"network","line_end":201,"severity":"medium","line_start":201},{"id":"network:scripts/send_email_notification.py:203:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"except smtplib.SMTPException as exc:","category":"network","line_end":203,"severity":"medium","line_start":203},{"id":"network:scripts/send_email_notification.py:5:python-email-libraries","file":"scripts/send_email_notification.py","pattern":"Python email libraries","snippet":"import smtplib","category":"network","line_end":5,"severity":"medium","line_start":5},{"id":"network:scripts/send_email_notification.py:190:python-email-libraries","file":"scripts/send_email_notification.py","pattern":"Python email libraries","snippet":"client: smtplib.SMTP = smtplib.SMTP_SSL(","category":"network","line_end":190,"severity":"medium","line_start":190},{"id":"network:scripts/send_email_notification.py:194:python-email-libraries","file":"scripts/send_email_notification.py","pattern":"Python email libraries","snippet":"client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)","category":"network","line_end":194,"severity":"medium","line_start":194},{"id":"network:scripts/send_email_notification.py:203:python-email-libraries","file":"scripts/send_email_notification.py","pattern":"Python email libraries","snippet":"except smtplib.SMTPException as exc:","category":"network","line_end":203,"severity":"medium","line_start":203},{"id":"env_access:scripts/send_email_notification.py:71:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"value = os.environ.get(name)","category":"env_access","line_end":71,"severity":"low","line_start":71},{"id":"env_access:scripts/send_email_notification.py:102:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"machine_name = os.environ.get(\"CODEX_MACHINE_NAME\")","category":"env_access","line_end":102,"severity":"low","line_start":102},{"id":"env_access:scripts/send_email_notification.py:103:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_host = os.environ.get(\"CODEX_EMAIL_SMTP_HOST\")","category":"env_access","line_end":103,"severity":"low","line_start":103},{"id":"env_access:scripts/send_email_notification.py:104:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_port_raw = os.environ.get(\"CODEX_EMAIL_SMTP_PORT\", \"587\")","category":"env_access","line_end":104,"severity":"low","line_start":104},{"id":"env_access:scripts/send_email_notification.py:105:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_user = os.environ.get(\"CODEX_EMAIL_USERNAME\")","category":"env_access","line_end":105,"severity":"low","line_start":105},{"id":"env_access:scripts/send_email_notification.py:106:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_password = os.environ.get(\"CODEX_EMAIL_PASSWORD\")","category":"env_access","line_end":106,"severity":"low","line_start":106},{"id":"env_access:scripts/send_email_notification.py:107:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_from = os.environ.get(\"CODEX_EMAIL_FROM\")","category":"env_access","line_end":107,"severity":"low","line_start":107},{"id":"env_access:scripts/send_email_notification.py:108:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_to_raw = os.environ.get(\"CODEX_EMAIL_TO\")","category":"env_access","line_end":108,"severity":"low","line_start":108},{"id":"blocker:scripts/send_email_notification.py:79:system-reconnaissance","file":"scripts/send_email_notification.py","pattern":"System reconnaissance","snippet":"raise ValueError(f\"Invalid {name} value: {value}\")","category":"blocker","line_end":79,"severity":"low","line_start":79},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":28,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If your SMTP server does not require auth, leave `CODEX_EMAIL_USERNAME` and `CODEX_EMAIL_PASSWORD` u","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Set `CODEX_EMAIL_USE_SSL` to `true` for SMTPS (typically port 465) and `CODEX_EMAIL_USE_TLS` to `tru","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Do not set both `CODEX_EMAIL_USE_TLS` and `CODEX_EMAIL_USE_SSL` to `true`.","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- To override the folder name, define a project name in `AGENTS.md` using one of:","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- YAML frontmatter: `project_name: My Project` (or `name:`)","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A plain line: `Project Name: My Project`","category":"external_commands","line_end":51,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Pick an execution status: `success`, `failed`, `partial`, `blocked`, etc.","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":66,"severity":"medium","line_start":62},{"id":"network:SKILL.md:3:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"description: Send SMTP email notifications after Codex completes a task. Use when one Codex or Claud","category":"network","line_end":3,"severity":"medium","line_start":3},{"id":"network:SKILL.md:10:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"Send an email notification after each Codex task. Use the helper script to resolve the project name ","category":"network","line_end":10,"severity":"medium","line_start":10},{"id":"network:SKILL.md:20:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"export CODEX_EMAIL_SMTP_HOST=\"smtp.example.com\"","category":"network","line_end":20,"severity":"medium","line_start":20},{"id":"network:SKILL.md:21:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"export CODEX_EMAIL_SMTP_PORT=\"587\"","category":"network","line_end":21,"severity":"medium","line_start":21},{"id":"network:SKILL.md:30:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"If your SMTP server does not require auth, leave `CODEX_EMAIL_USERNAME` and `CODEX_EMAIL_PASSWORD` u","category":"network","line_end":30,"severity":"medium","line_start":30},{"id":"network:SKILL.md:31:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"Set `CODEX_EMAIL_USE_SSL` to `true` for SMTPS (typically port 465) and `CODEX_EMAIL_USE_TLS` to `tru","category":"network","line_end":31,"severity":"medium","line_start":31},{"id":"filesystem:SKILL.md:16:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:SKILL.md:57:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"python3 ~/.codex/skills/email-notify/scripts/send_email_notification.py \\","category":"filesystem","line_end":57,"severity":"high","line_start":57},{"id":"filesystem:SKILL.md:16:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","category":"filesystem","line_end":16,"severity":"medium","line_start":16},{"id":"filesystem:SKILL.md:57:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"python3 ~/.codex/skills/email-notify/scripts/send_email_notification.py \\","category":"filesystem","line_end":57,"severity":"medium","line_start":57},{"id":"blocker:SKILL.md:52:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Write a brief result summary; avoid secrets.","category":"blocker","line_end":52,"severity":"low","line_start":52}],"finding_verdicts":[{"id":"network:scripts/send_email_notification.py:5:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:89:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:103:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:104:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:105:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:106:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:107:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:108:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:113:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:114:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:116:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:119:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:122:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:125:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:130:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:132:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:145:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:173:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:178:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:179:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:182:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:190:email-sending-capability","reason":"This line participates directly in SMTP connection, authentication, or delivery. The skill can send task data to an external mail server.","verdict":"confirmed","severity":"medium","confidence":0.92},{"id":"network:scripts/send_email_notification.py:191:email-sending-capability","reason":"This line participates directly in SMTP connection, authentication, or delivery. The skill can send task data to an external mail server.","verdict":"confirmed","severity":"medium","confidence":0.92},{"id":"network:scripts/send_email_notification.py:194:email-sending-capability","reason":"This line participates directly in SMTP connection, authentication, or delivery. The skill can send task data to an external mail server.","verdict":"confirmed","severity":"medium","confidence":0.92},{"id":"network:scripts/send_email_notification.py:200:email-sending-capability","reason":"This line configures or constructs the SMTP notification path. It supports sending task status and summary data outside the local workspace.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:scripts/send_email_notification.py:201:email-sending-capability","reason":"This line participates directly in SMTP connection, authentication, or delivery. The skill can send task data to an external mail server.","verdict":"confirmed","severity":"medium","confidence":0.92},{"id":"network:scripts/send_email_notification.py:203:email-sending-capability","reason":"This line only validates settings, prints dry-run fields, or handles errors. It does not itself create a network connection or send email.","verdict":"false_positive","confidence":0.78},{"id":"network:scripts/send_email_notification.py:5:python-email-libraries","reason":"The script imports and uses smtplib to create SMTP or SMTPS clients. That is direct network email functionality.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"network:scripts/send_email_notification.py:190:python-email-libraries","reason":"The script imports and uses smtplib to create SMTP or SMTPS clients. That is direct network email functionality.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"network:scripts/send_email_notification.py:194:python-email-libraries","reason":"The script imports and uses smtplib to create SMTP or SMTPS clients. That is direct network email functionality.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"network:scripts/send_email_notification.py:203:python-email-libraries","reason":"This line only catches SMTP-specific exceptions after the send attempt. The actual network behavior is covered by other confirmed findings.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/send_email_notification.py:71:python-environment-access","reason":"The helper reads named environment values for TLS and SSL options. Access is limited to configured names, but environment access is real.","verdict":"confirmed","severity":"low","confidence":0.7},{"id":"env_access:scripts/send_email_notification.py:102:python-environment-access","reason":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details.","verdict":"confirmed","severity":"low","confidence":0.82},{"id":"env_access:scripts/send_email_notification.py:103:python-environment-access","reason":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details.","verdict":"confirmed","severity":"low","confidence":0.82},{"id":"env_access:scripts/send_email_notification.py:104:python-environment-access","reason":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details.","verdict":"confirmed","severity":"low","confidence":0.82},{"id":"env_access:scripts/send_email_notification.py:105:python-environment-access","reason":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details.","verdict":"confirmed","severity":"low","confidence":0.82},{"id":"env_access:scripts/send_email_notification.py:106:python-environment-access","reason":"The script reads CODEX_EMAIL_PASSWORD from the environment for SMTP login. This is expected, but it gives the skill process access to an email credential.","verdict":"confirmed","severity":"low","confidence":0.88},{"id":"env_access:scripts/send_email_notification.py:107:python-environment-access","reason":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details.","verdict":"confirmed","severity":"low","confidence":0.82},{"id":"env_access:scripts/send_email_notification.py:108:python-environment-access","reason":"The script reads named CODEX email and machine settings from the environment. This is legitimate configuration access, but it can include sensitive SMTP details.","verdict":"confirmed","severity":"low","confidence":0.82},{"id":"blocker:scripts/send_email_notification.py:79:system-reconnaissance","reason":"This line raises a validation error for a malformed boolean environment value. It does not collect host, user, process, or network reconnaissance data.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The workflow includes a shell command that runs the Python notification helper. The command is expected, but it executes local code and passes user-controlled task text as arguments.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"This SKILL.md hit is Markdown formatting, inline documentation, or a shell environment example. It is not Ruby backtick execution or a command injection sink.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:3:email-sending-capability","reason":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:SKILL.md:10:email-sending-capability","reason":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:SKILL.md:20:email-sending-capability","reason":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:SKILL.md:21:email-sending-capability","reason":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:SKILL.md:30:email-sending-capability","reason":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:SKILL.md:31:email-sending-capability","reason":"The documentation instructs users to configure SMTP delivery settings. This confirms expected email-sending behavior and a real external data transmission path.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"filesystem:SKILL.md:16:hidden-file-in-home-directory","reason":"The setup instructions direct users to place notification settings in shell startup dotfiles. This can persist plaintext SMTP credentials in hidden home-directory files.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"filesystem:SKILL.md:57:hidden-file-in-home-directory","reason":"The path is the normal Codex skill install location used to run the helper script. This line does not show arbitrary hidden file reading, writing, or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:16:hidden-file-access","reason":"The setup instructions direct users to place notification settings in shell startup dotfiles. This can persist plaintext SMTP credentials in hidden home-directory files.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"filesystem:SKILL.md:57:hidden-file-access","reason":"The path is the normal Codex skill install location used to run the helper script. This line does not show arbitrary hidden file reading, writing, or persistence.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:52:system-reconnaissance","reason":"The documentation tells users to avoid secrets in a summary. This is protective guidance, not system reconnaissance.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[{"title":"Plaintext SMTP Credential Storage Guidance","severity":"high","locations":[{"file":"SKILL.md","line_end":27,"line_start":16}],"confidence":0.9,"description":"The setup instructions tell users to place CODEX_EMAIL_PASSWORD in shell startup files. This can persist SMTP credentials in plaintext dotfiles.","confidence_reasoning":"SKILL.md explicitly shows CODEX_EMAIL_PASSWORD in the shell profile export block. The storage risk follows directly from the documented setup."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":35,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}