{"data":{"skill":{"slug":"caopulan-email-notify","name":"email-notify","icon":"📦","repo":"https://github.com/caopulan/Notification-Skill/tree/main/email-notify","status":"approved","author":"caopulan","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"73c4c468-8692-442f-9857-d4afb25c8740","skill_id":"46749970-16c9-4c01-83ea-f1ce73a47891","version":8,"content_hash":"v2:c5da72cf0b2c3c9233a9054b45c562b20791c24f:a80a99e48c02163a9ba11068e8f1fc062e56bf04ff4adaff4a843740004276ea:7de180c241fb2edac9021331deb39d7538fd02536cf439a20cc7a9aafd2a54db:bfc28d227998611167c38634201fb68f","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The skill intentionally sends SMTP email through user-configured settings and reads SMTP credentials from environment variables. I confirmed the outbound email capability and shell-profile credential guidance, and dismissed markdown backtick and system reconnaissance matches as false positives.","remediation":[{"issue":"SMTP credentials are documented for shell startup files.","severity":"high","suggestion":"Recommend a dedicated secret manager or a restricted-permission env file instead of exporting CODEX_EMAIL_PASSWORD globally."},{"issue":"Task summaries can be sent outside the local workspace by email.","severity":"medium","suggestion":"Keep notifications minimal, sanitize summaries, and document that secrets and private data must not be included."},{"issue":"Outbound SMTP delivery depends on user-provided recipients and server settings.","severity":"medium","suggestion":"Require explicit user opt-in before first use and encourage dry-run verification of recipients and transport mode."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"scripts/send_email_notification.py","line_end":5,"line_start":5},{"file":"scripts/send_email_notification.py","line_end":89,"line_start":89},{"file":"scripts/send_email_notification.py","line_end":103,"line_start":103},{"file":"scripts/send_email_notification.py","line_end":104,"line_start":104},{"file":"scripts/send_email_notification.py","line_end":105,"line_start":105},{"file":"scripts/send_email_notification.py","line_end":106,"line_start":106},{"file":"scripts/send_email_notification.py","line_end":107,"line_start":107},{"file":"scripts/send_email_notification.py","line_end":108,"line_start":108},{"file":"scripts/send_email_notification.py","line_end":113,"line_start":113},{"file":"scripts/send_email_notification.py","line_end":114,"line_start":114},{"file":"scripts/send_email_notification.py","line_end":116,"line_start":116},{"file":"scripts/send_email_notification.py","line_end":119,"line_start":119},{"file":"scripts/send_email_notification.py","line_end":122,"line_start":122},{"file":"scripts/send_email_notification.py","line_end":125,"line_start":125},{"file":"scripts/send_email_notification.py","line_end":130,"line_start":130},{"file":"scripts/send_email_notification.py","line_end":132,"line_start":132},{"file":"scripts/send_email_notification.py","line_end":145,"line_start":145},{"file":"scripts/send_email_notification.py","line_end":173,"line_start":173},{"file":"scripts/send_email_notification.py","line_end":178,"line_start":178},{"file":"scripts/send_email_notification.py","line_end":179,"line_start":179},{"file":"scripts/send_email_notification.py","line_end":182,"line_start":182},{"file":"scripts/send_email_notification.py","line_end":190,"line_start":190},{"file":"scripts/send_email_notification.py","line_end":191,"line_start":191},{"file":"scripts/send_email_notification.py","line_end":194,"line_start":194},{"file":"scripts/send_email_notification.py","line_end":200,"line_start":200},{"file":"scripts/send_email_notification.py","line_end":201,"line_start":201},{"file":"scripts/send_email_notification.py","line_end":203,"line_start":203},{"file":"scripts/send_email_notification.py","line_end":5,"line_start":5},{"file":"scripts/send_email_notification.py","line_end":190,"line_start":190},{"file":"scripts/send_email_notification.py","line_end":194,"line_start":194},{"file":"scripts/send_email_notification.py","line_end":203,"line_start":203},{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31}]},{"factor":"env_access","evidence":[{"file":"scripts/send_email_notification.py","line_end":71,"line_start":71},{"file":"scripts/send_email_notification.py","line_end":102,"line_start":102},{"file":"scripts/send_email_notification.py","line_end":103,"line_start":103},{"file":"scripts/send_email_notification.py","line_end":104,"line_start":104},{"file":"scripts/send_email_notification.py","line_end":105,"line_start":105},{"file":"scripts/send_email_notification.py","line_end":106,"line_start":106},{"file":"scripts/send_email_notification.py","line_end":107,"line_start":107},{"file":"scripts/send_email_notification.py","line_end":108,"line_start":108}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":28,"line_start":18},{"file":"SKILL.md","line_end":30,"line_start":28},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":51,"line_start":45},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":66,"line_start":62}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":57,"line_start":57}]}],"critical_findings":[],"high_findings":[{"title":"Hidden file in home directory","locations":[{"file":"SKILL.md","line_end":16,"line_start":16}],"confidence":0.88,"description":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The setup instructions direct users to put exported SMTP settings, including an email password, in shell startup files. This can persist sensitive credentials in plaintext in hidden home-directory files."},{"title":"Plaintext SMTP Credential Storage Guidance","locations":[{"file":"SKILL.md","line_end":27,"line_start":16}],"confidence":0.9,"description":"The setup guide recommends exporting SMTP settings, including CODEX_EMAIL_PASSWORD, from shell startup files. This can persist an email password in plaintext and expose it to future shell sessions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"SKILL.md directs users to edit ~/.bashrc or ~/.zshrc and includes CODEX_EMAIL_PASSWORD in the exported variables. That is clear evidence of plaintext credential storage guidance."}],"medium_findings":[{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":5,"line_start":5}],"confidence":0.86,"description":"import smtplib","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":89,"line_start":89}],"confidence":0.86,"description":"description=\"Send an SMTP email notification for a Codex task.\"","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":103,"line_start":103}],"confidence":0.86,"description":"smtp_host = os.environ.get(\"CODEX_EMAIL_SMTP_HOST\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":104,"line_start":104}],"confidence":0.86,"description":"smtp_port_raw = os.environ.get(\"CODEX_EMAIL_SMTP_PORT\", \"587\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":105,"line_start":105}],"confidence":0.86,"description":"smtp_user = os.environ.get(\"CODEX_EMAIL_USERNAME\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":106,"line_start":106}],"confidence":0.86,"description":"smtp_password = os.environ.get(\"CODEX_EMAIL_PASSWORD\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":107,"line_start":107}],"confidence":0.86,"description":"smtp_from = os.environ.get(\"CODEX_EMAIL_FROM\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":108,"line_start":108}],"confidence":0.86,"description":"smtp_to_raw = os.environ.get(\"CODEX_EMAIL_TO\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":113,"line_start":113}],"confidence":0.86,"description":"if not smtp_host:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":114,"line_start":114}],"confidence":0.86,"description":"sys.stderr.write(\"Missing CODEX_EMAIL_SMTP_HOST.\\n\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":116,"line_start":116}],"confidence":0.86,"description":"if not smtp_from:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":119,"line_start":119}],"confidence":0.86,"description":"if not smtp_to_raw:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":122,"line_start":122}],"confidence":0.86,"description":"if smtp_user and not smtp_password:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":125,"line_start":125}],"confidence":0.86,"description":"if smtp_password and not smtp_user:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":130,"line_start":130}],"confidence":0.86,"description":"smtp_port = int(smtp_port_raw)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":132,"line_start":132}],"confidence":0.86,"description":"sys.stderr.write(\"CODEX_EMAIL_SMTP_PORT must be an integer.\\n\")","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":145,"line_start":145}],"confidence":0.86,"description":"recipients = _split_recipients(smtp_to_raw)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":173,"line_start":173}],"confidence":0.86,"description":"msg[\"From\"] = smtp_from","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":178,"line_start":178}],"confidence":0.86,"description":"print(\"SMTP host:\", smtp_host)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":179,"line_start":179}],"confidence":0.86,"description":"print(\"SMTP port:\", smtp_port)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":182,"line_start":182}],"confidence":0.86,"description":"print(\"from:\", smtp_from)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":190,"line_start":190}],"confidence":0.86,"description":"client: smtplib.SMTP = smtplib.SMTP_SSL(","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":191,"line_start":191}],"confidence":0.86,"description":"smtp_host, smtp_port, timeout=args.timeout","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":194,"line_start":194}],"confidence":0.86,"description":"client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":200,"line_start":200}],"confidence":0.86,"description":"if smtp_user:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":201,"line_start":201}],"confidence":0.86,"description":"client.login(smtp_user, smtp_password)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"scripts/send_email_notification.py","line_end":203,"line_start":203}],"confidence":0.86,"description":"except smtplib.SMTPException as exc:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Python email libraries","locations":[{"file":"scripts/send_email_notification.py","line_end":5,"line_start":5}],"confidence":0.86,"description":"import smtplib","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Python email libraries","locations":[{"file":"scripts/send_email_notification.py","line_end":190,"line_start":190}],"confidence":0.86,"description":"client: smtplib.SMTP = smtplib.SMTP_SSL(","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Python email libraries","locations":[{"file":"scripts/send_email_notification.py","line_end":194,"line_start":194}],"confidence":0.86,"description":"client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Python email libraries","locations":[{"file":"scripts/send_email_notification.py","line_end":203,"line_start":203}],"confidence":0.86,"description":"except smtplib.SMTPException as exc:","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":0.82,"description":"description: Send SMTP email notifications after Codex completes a task. Use when one Codex or Claud","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":10,"line_start":10}],"confidence":0.82,"description":"Send an email notification after each Codex task. Use the helper script to resolve the project name ","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":20,"line_start":20}],"confidence":0.82,"description":"export CODEX_EMAIL_SMTP_HOST=\"smtp.example.com\"","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":21,"line_start":21}],"confidence":0.82,"description":"export CODEX_EMAIL_SMTP_PORT=\"587\"","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":30,"line_start":30}],"confidence":0.82,"description":"If your SMTP server does not require auth, leave `CODEX_EMAIL_USERNAME` and `CODEX_EMAIL_PASSWORD` u","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior."},{"title":"Email sending capability","locations":[{"file":"SKILL.md","line_end":31,"line_start":31}],"confidence":0.82,"description":"Set `CODEX_EMAIL_USE_SSL` to `true` for SMTPS (typically port 465) and `CODEX_EMAIL_USE_TLS` to `tru","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior."},{"title":"Hidden file access","locations":[{"file":"SKILL.md","line_end":16,"line_start":16}],"confidence":0.88,"description":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The setup instructions direct users to put exported SMTP settings, including an email password, in shell startup files. This can persist sensitive credentials in plaintext in hidden home-directory files."}],"low_findings":[{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":105,"line_start":105}],"confidence":0.78,"description":"smtp_user = os.environ.get(\"CODEX_EMAIL_USERNAME\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads SMTP account credentials from environment variables. This is expected for SMTP login, but access to credential material is security-sensitive."},{"title":"Python environment access","locations":[{"file":"scripts/send_email_notification.py","line_end":106,"line_start":106}],"confidence":0.78,"description":"smtp_password = os.environ.get(\"CODEX_EMAIL_PASSWORD\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The script reads SMTP account credentials from environment variables. This is expected for SMTP login, but access to credential material is security-sensitive."}],"dangerous_patterns":[],"files_scanned":2,"total_lines":282,"audit_model":"codex","audited_at":"2026-07-08T04:03:06.771+00:00","created_at":"2026-07-08T04:36:15.916452+00:00","static_findings":[{"id":"network:scripts/send_email_notification.py:5:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"import smtplib","category":"network","line_end":5,"severity":"medium","line_start":5},{"id":"network:scripts/send_email_notification.py:89:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"description=\"Send an SMTP email notification for a Codex task.\"","category":"network","line_end":89,"severity":"medium","line_start":89},{"id":"network:scripts/send_email_notification.py:103:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_host = os.environ.get(\"CODEX_EMAIL_SMTP_HOST\")","category":"network","line_end":103,"severity":"medium","line_start":103},{"id":"network:scripts/send_email_notification.py:104:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_port_raw = os.environ.get(\"CODEX_EMAIL_SMTP_PORT\", \"587\")","category":"network","line_end":104,"severity":"medium","line_start":104},{"id":"network:scripts/send_email_notification.py:105:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_user = os.environ.get(\"CODEX_EMAIL_USERNAME\")","category":"network","line_end":105,"severity":"medium","line_start":105},{"id":"network:scripts/send_email_notification.py:106:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_password = os.environ.get(\"CODEX_EMAIL_PASSWORD\")","category":"network","line_end":106,"severity":"medium","line_start":106},{"id":"network:scripts/send_email_notification.py:107:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_from = os.environ.get(\"CODEX_EMAIL_FROM\")","category":"network","line_end":107,"severity":"medium","line_start":107},{"id":"network:scripts/send_email_notification.py:108:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_to_raw = os.environ.get(\"CODEX_EMAIL_TO\")","category":"network","line_end":108,"severity":"medium","line_start":108},{"id":"network:scripts/send_email_notification.py:113:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if not smtp_host:","category":"network","line_end":113,"severity":"medium","line_start":113},{"id":"network:scripts/send_email_notification.py:114:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"sys.stderr.write(\"Missing CODEX_EMAIL_SMTP_HOST.\\n\")","category":"network","line_end":114,"severity":"medium","line_start":114},{"id":"network:scripts/send_email_notification.py:116:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if not smtp_from:","category":"network","line_end":116,"severity":"medium","line_start":116},{"id":"network:scripts/send_email_notification.py:119:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if not smtp_to_raw:","category":"network","line_end":119,"severity":"medium","line_start":119},{"id":"network:scripts/send_email_notification.py:122:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if smtp_user and not smtp_password:","category":"network","line_end":122,"severity":"medium","line_start":122},{"id":"network:scripts/send_email_notification.py:125:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if smtp_password and not smtp_user:","category":"network","line_end":125,"severity":"medium","line_start":125},{"id":"network:scripts/send_email_notification.py:130:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_port = int(smtp_port_raw)","category":"network","line_end":130,"severity":"medium","line_start":130},{"id":"network:scripts/send_email_notification.py:132:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"sys.stderr.write(\"CODEX_EMAIL_SMTP_PORT must be an integer.\\n\")","category":"network","line_end":132,"severity":"medium","line_start":132},{"id":"network:scripts/send_email_notification.py:145:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"recipients = _split_recipients(smtp_to_raw)","category":"network","line_end":145,"severity":"medium","line_start":145},{"id":"network:scripts/send_email_notification.py:173:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"msg[\"From\"] = smtp_from","category":"network","line_end":173,"severity":"medium","line_start":173},{"id":"network:scripts/send_email_notification.py:178:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"print(\"SMTP host:\", smtp_host)","category":"network","line_end":178,"severity":"medium","line_start":178},{"id":"network:scripts/send_email_notification.py:179:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"print(\"SMTP port:\", smtp_port)","category":"network","line_end":179,"severity":"medium","line_start":179},{"id":"network:scripts/send_email_notification.py:182:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"print(\"from:\", smtp_from)","category":"network","line_end":182,"severity":"medium","line_start":182},{"id":"network:scripts/send_email_notification.py:190:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"client: smtplib.SMTP = smtplib.SMTP_SSL(","category":"network","line_end":190,"severity":"medium","line_start":190},{"id":"network:scripts/send_email_notification.py:191:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"smtp_host, smtp_port, timeout=args.timeout","category":"network","line_end":191,"severity":"medium","line_start":191},{"id":"network:scripts/send_email_notification.py:194:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)","category":"network","line_end":194,"severity":"medium","line_start":194},{"id":"network:scripts/send_email_notification.py:200:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"if smtp_user:","category":"network","line_end":200,"severity":"medium","line_start":200},{"id":"network:scripts/send_email_notification.py:201:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"client.login(smtp_user, smtp_password)","category":"network","line_end":201,"severity":"medium","line_start":201},{"id":"network:scripts/send_email_notification.py:203:email-sending-capability","file":"scripts/send_email_notification.py","pattern":"Email sending capability","snippet":"except smtplib.SMTPException as exc:","category":"network","line_end":203,"severity":"medium","line_start":203},{"id":"network:scripts/send_email_notification.py:5:python-email-libraries","file":"scripts/send_email_notification.py","pattern":"Python email libraries","snippet":"import smtplib","category":"network","line_end":5,"severity":"medium","line_start":5},{"id":"network:scripts/send_email_notification.py:190:python-email-libraries","file":"scripts/send_email_notification.py","pattern":"Python email libraries","snippet":"client: smtplib.SMTP = smtplib.SMTP_SSL(","category":"network","line_end":190,"severity":"medium","line_start":190},{"id":"network:scripts/send_email_notification.py:194:python-email-libraries","file":"scripts/send_email_notification.py","pattern":"Python email libraries","snippet":"client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)","category":"network","line_end":194,"severity":"medium","line_start":194},{"id":"network:scripts/send_email_notification.py:203:python-email-libraries","file":"scripts/send_email_notification.py","pattern":"Python email libraries","snippet":"except smtplib.SMTPException as exc:","category":"network","line_end":203,"severity":"medium","line_start":203},{"id":"env_access:scripts/send_email_notification.py:71:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"value = os.environ.get(name)","category":"env_access","line_end":71,"severity":"low","line_start":71},{"id":"env_access:scripts/send_email_notification.py:102:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"machine_name = os.environ.get(\"CODEX_MACHINE_NAME\")","category":"env_access","line_end":102,"severity":"low","line_start":102},{"id":"env_access:scripts/send_email_notification.py:103:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_host = os.environ.get(\"CODEX_EMAIL_SMTP_HOST\")","category":"env_access","line_end":103,"severity":"low","line_start":103},{"id":"env_access:scripts/send_email_notification.py:104:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_port_raw = os.environ.get(\"CODEX_EMAIL_SMTP_PORT\", \"587\")","category":"env_access","line_end":104,"severity":"low","line_start":104},{"id":"env_access:scripts/send_email_notification.py:105:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_user = os.environ.get(\"CODEX_EMAIL_USERNAME\")","category":"env_access","line_end":105,"severity":"low","line_start":105},{"id":"env_access:scripts/send_email_notification.py:106:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_password = os.environ.get(\"CODEX_EMAIL_PASSWORD\")","category":"env_access","line_end":106,"severity":"low","line_start":106},{"id":"env_access:scripts/send_email_notification.py:107:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_from = os.environ.get(\"CODEX_EMAIL_FROM\")","category":"env_access","line_end":107,"severity":"low","line_start":107},{"id":"env_access:scripts/send_email_notification.py:108:python-environment-access","file":"scripts/send_email_notification.py","pattern":"Python environment access","snippet":"smtp_to_raw = os.environ.get(\"CODEX_EMAIL_TO\")","category":"env_access","line_end":108,"severity":"low","line_start":108},{"id":"blocker:scripts/send_email_notification.py:79:system-reconnaissance","file":"scripts/send_email_notification.py","pattern":"System reconnaissance","snippet":"raise ValueError(f\"Invalid {name} value: {value}\")","category":"blocker","line_end":79,"severity":"low","line_start":79},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":28,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If your SMTP server does not require auth, leave `CODEX_EMAIL_USERNAME` and `CODEX_EMAIL_PASSWORD` u","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Set `CODEX_EMAIL_USE_SSL` to `true` for SMTPS (typically port 465) and `CODEX_EMAIL_USE_TLS` to `tru","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Do not set both `CODEX_EMAIL_USE_TLS` and `CODEX_EMAIL_USE_SSL` to `true`.","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- To override the folder name, define a project name in `AGENTS.md` using one of:","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- YAML frontmatter: `project_name: My Project` (or `name:`)","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A plain line: `Project Name: My Project`","category":"external_commands","line_end":51,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Pick an execution status: `success`, `failed`, `partial`, `blocked`, etc.","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":66,"severity":"medium","line_start":62},{"id":"network:SKILL.md:3:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"description: Send SMTP email notifications after Codex completes a task. Use when one Codex or Claud","category":"network","line_end":3,"severity":"medium","line_start":3},{"id":"network:SKILL.md:10:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"Send an email notification after each Codex task. Use the helper script to resolve the project name ","category":"network","line_end":10,"severity":"medium","line_start":10},{"id":"network:SKILL.md:20:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"export CODEX_EMAIL_SMTP_HOST=\"smtp.example.com\"","category":"network","line_end":20,"severity":"medium","line_start":20},{"id":"network:SKILL.md:21:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"export CODEX_EMAIL_SMTP_PORT=\"587\"","category":"network","line_end":21,"severity":"medium","line_start":21},{"id":"network:SKILL.md:30:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"If your SMTP server does not require auth, leave `CODEX_EMAIL_USERNAME` and `CODEX_EMAIL_PASSWORD` u","category":"network","line_end":30,"severity":"medium","line_start":30},{"id":"network:SKILL.md:31:email-sending-capability","file":"SKILL.md","pattern":"Email sending capability","snippet":"Set `CODEX_EMAIL_USE_SSL` to `true` for SMTPS (typically port 465) and `CODEX_EMAIL_USE_TLS` to `tru","category":"network","line_end":31,"severity":"medium","line_start":31},{"id":"filesystem:SKILL.md:16:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:SKILL.md:57:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"python3 ~/.codex/skills/email-notify/scripts/send_email_notification.py \\","category":"filesystem","line_end":57,"severity":"high","line_start":57},{"id":"filesystem:SKILL.md:16:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):","category":"filesystem","line_end":16,"severity":"medium","line_start":16},{"id":"filesystem:SKILL.md:57:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"python3 ~/.codex/skills/email-notify/scripts/send_email_notification.py \\","category":"filesystem","line_end":57,"severity":"medium","line_start":57},{"id":"blocker:SKILL.md:52:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Write a brief result summary; avoid secrets.","category":"blocker","line_end":52,"severity":"low","line_start":52}],"finding_verdicts":[{"id":"network:scripts/send_email_notification.py:5:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:89:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:103:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:104:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:105:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:106:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:107:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:108:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:113:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:114:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:116:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:119:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:122:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:125:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:130:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:132:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:145:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:173:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:178:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:179:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:182:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:190:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:191:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:194:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:200:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:201:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:203:email-sending-capability","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:5:python-email-libraries","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:190:python-email-libraries","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:194:python-email-libraries","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"network:scripts/send_email_notification.py:203:python-email-libraries","reason":"The helper implements outbound SMTP email and can send task metadata and summaries to configured recipients. This is intended behavior, but it is a real network data-transfer capability.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"env_access:scripts/send_email_notification.py:71:python-environment-access","reason":"This reads user-provided notification settings such as host, port, sender, recipient, or TLS flags. No evidence shows these values are collected beyond the configured email workflow.","verdict":"false_positive","confidence":0.81},{"id":"env_access:scripts/send_email_notification.py:102:python-environment-access","reason":"This reads user-provided notification settings such as host, port, sender, recipient, or TLS flags. No evidence shows these values are collected beyond the configured email workflow.","verdict":"false_positive","confidence":0.81},{"id":"env_access:scripts/send_email_notification.py:103:python-environment-access","reason":"This reads user-provided notification settings such as host, port, sender, recipient, or TLS flags. No evidence shows these values are collected beyond the configured email workflow.","verdict":"false_positive","confidence":0.81},{"id":"env_access:scripts/send_email_notification.py:104:python-environment-access","reason":"This reads user-provided notification settings such as host, port, sender, recipient, or TLS flags. No evidence shows these values are collected beyond the configured email workflow.","verdict":"false_positive","confidence":0.81},{"id":"env_access:scripts/send_email_notification.py:105:python-environment-access","reason":"The script reads SMTP account credentials from environment variables. This is expected for SMTP login, but access to credential material is security-sensitive.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"env_access:scripts/send_email_notification.py:106:python-environment-access","reason":"The script reads SMTP account credentials from environment variables. This is expected for SMTP login, but access to credential material is security-sensitive.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"env_access:scripts/send_email_notification.py:107:python-environment-access","reason":"This reads user-provided notification settings such as host, port, sender, recipient, or TLS flags. No evidence shows these values are collected beyond the configured email workflow.","verdict":"false_positive","confidence":0.81},{"id":"env_access:scripts/send_email_notification.py:108:python-environment-access","reason":"This reads user-provided notification settings such as host, port, sender, recipient, or TLS flags. No evidence shows these values are collected beyond the configured email workflow.","verdict":"false_positive","confidence":0.81},{"id":"blocker:scripts/send_email_notification.py:79:system-reconnaissance","reason":"The cited text is validation or safety guidance, not host reconnaissance. No evidence shows collection of system inventory or privilege information.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The match is markdown formatting, inline examples, or a user-facing command block in SKILL.md. It is not Ruby backtick execution or dynamic command execution inside code.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:3:email-sending-capability","reason":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"network:SKILL.md:10:email-sending-capability","reason":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"network:SKILL.md:20:email-sending-capability","reason":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"network:SKILL.md:21:email-sending-capability","reason":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"network:SKILL.md:30:email-sending-capability","reason":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"network:SKILL.md:31:email-sending-capability","reason":"The documentation instructs users to configure SMTP email delivery for task notifications. This confirms the skill has intentional outbound email behavior.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:SKILL.md:16:hidden-file-in-home-directory","reason":"The setup instructions direct users to put exported SMTP settings, including an email password, in shell startup files. This can persist sensitive credentials in plaintext in hidden home-directory files.","verdict":"confirmed","severity":"high","confidence":0.88},{"id":"filesystem:SKILL.md:57:hidden-file-in-home-directory","reason":"The path references the normal installed skill location under ~/.codex for running the helper script. No evidence shows hidden persistence, stealth storage, or unauthorized file access.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:16:hidden-file-access","reason":"The setup instructions direct users to put exported SMTP settings, including an email password, in shell startup files. This can persist sensitive credentials in plaintext in hidden home-directory files.","verdict":"confirmed","severity":"medium","confidence":0.88},{"id":"filesystem:SKILL.md:57:hidden-file-access","reason":"The path references the normal installed skill location under ~/.codex for running the helper script. No evidence shows hidden persistence, stealth storage, or unauthorized file access.","verdict":"false_positive","confidence":0.84},{"id":"blocker:SKILL.md:52:system-reconnaissance","reason":"The cited text is validation or safety guidance, not host reconnaissance. No evidence shows collection of system inventory or privilege information.","verdict":"false_positive","confidence":0.94}],"semantic_findings":[{"title":"Plaintext SMTP Credential Storage Guidance","severity":"high","locations":[{"file":"SKILL.md","line_end":27,"line_start":16}],"confidence":0.9,"description":"The setup guide recommends exporting SMTP settings, including CODEX_EMAIL_PASSWORD, from shell startup files. This can persist an email password in plaintext and expose it to future shell sessions.","confidence_reasoning":"SKILL.md directs users to edit ~/.bashrc or ~/.zshrc and includes CODEX_EMAIL_PASSWORD in the exported variables. That is clear evidence of plaintext credential storage guidance."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":41,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}