Skills email-notify

📦

email-notify

Name: email-notify
Author: caopulan

Content revision r2 High Risk 🌐 Network access🔑 Env variables⚙️ External commands📁 Filesystem access

Send Task Completion Emails

Finished agent tasks can be missed when users leave the terminal. This skill sends concise SMTP emails with task status and project context.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "email-notify" from https://skillstore.io/skills/caopulan-email-notify.md and its manifest at https://skillstore.io/api/skills/caopulan-email-notify/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/caopulan-email-notify.md Signed manifest GET /api/skills/caopulan-email-notify/manifest Signed lockfile GET /api/skills/caopulan-email-notify/lockfile

Test it

Using "email-notify". Notify me that the Billing API tests passed.

Expected outcome:

Subject: Billing API tests passed
Device: build-runner
Project: Billing API
Status: success
Summary: All requested tests passed.

Using "email-notify". Report that deployment work is blocked by missing credentials.

Expected outcome:

Subject: Deployment blocked
Device: workstation
Project: Release Pipeline
Status: blocked
Summary: Deployment requires approved credentials before work can continue.

Using "email-notify". Preview a partial documentation update for the client portal.

Expected outcome:

Dry run: recipient and SMTP settings are displayed with the email subject and body. No message is sent.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Most static alerts are false positives caused by Markdown formatting, local validation, and scoped configuration reads. Confirmed risks include shell-profile credential storage, optional unencrypted SMTP authentication, environment access to the SMTP password, and intended outbound SMTP connections.

Files scanned

282

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/send_email_notification.py:194-201

Authenticated SMTP Can Run Without Encryption

When both TLS options are disabled, the plain SMTP path still calls login. Network observers could capture SMTP credentials and notification content.

The plain SMTP client is created on line 194, while STARTTLS is conditional and login remains available. The control flow directly confirms the exposure condition.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/send_email_notification.py:201

Email sending capability

client.login(smtp_user, smtp_password)

This transmits the configured SMTP username and password to the server. The credentials can cross an unencrypted connection when both transport-security options are disabled.

High

SKILL.md:16

Hidden file in home directory

Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):

The setup directs users to persist the SMTP password in a shell startup file. This exposes the credential to every child process and leaves it in a long-lived plaintext file.

High

SKILL.md:16

Hidden file access

Add the following lines to `~/.bashrc` (Linux) or `~/.zshrc` (macOS):

The documented edit places SMTP credentials in .bashrc or .zshrc. Persisting secrets in shell profiles broadens credential exposure beyond this skill.

Medium

scripts/send_email_notification.py:190

Email sending capability

client: smtplib.SMTP = smtplib.SMTP_SSL(

This creates an outbound SSL SMTP connection to the configured host. The connection is intended, but it is a real network and data-egress capability.

Medium

scripts/send_email_notification.py:191

Email sending capability

smtp_host, smtp_port, timeout=args.timeout

This supplies the configured host and port to the SSL SMTP client. It is part of the real outbound connection path.

Medium

scripts/send_email_notification.py:194

Email sending capability

client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)

This creates a plain SMTP connection before optional STARTTLS. It enables outbound traffic and can remain unencrypted when TLS is disabled.

Medium

scripts/send_email_notification.py:190

Python email libraries

client: smtplib.SMTP = smtplib.SMTP_SSL(

This uses the Python SMTP library to create an outbound SSL connection. It is an actual network operation rather than a library reference.

Medium

scripts/send_email_notification.py:194

Python email libraries

client = smtplib.SMTP(smtp_host, smtp_port, timeout=args.timeout)

This uses the Python SMTP library to open a network connection. STARTTLS is optional, so this path can remain unencrypted.

Low

scripts/send_email_notification.py:106

Python environment access

smtp_password = os.environ.get("CODEX_EMAIL_PASSWORD")

This reads a password from the process environment. The access is expected for SMTP authentication, but it gives the skill direct access to a credential.

Risk Factors

🌐 Network access (37)

🔑 Env variables (8)

scripts/send_email_notification.py:71 scripts/send_email_notification.py:102 scripts/send_email_notification.py:103 scripts/send_email_notification.py:104 scripts/send_email_notification.py:105 scripts/send_email_notification.py:106 scripts/send_email_notification.py:107 scripts/send_email_notification.py:108

⚙️ External commands (12)

SKILL.md:16 SKILL.md:18-28 SKILL.md:28-30 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:43-44 SKILL.md:44 SKILL.md:45-51 SKILL.md:51 SKILL.md:56-62 SKILL.md:62-66

📁 Filesystem access (4)

SKILL.md:16 SKILL.md:57 SKILL.md:16 SKILL.md:57

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/caopulan-email-notify/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/caopulan-email-notify/security.svg)](https://skillstore.io/skills/caopulan-email-notify?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/caopulan-email-notify?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caopulan-email-notify/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/caopulan-email-notify.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

caopulan. (2026). email-notify security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/caopulan-email-notify/audits/9

BibTeX citation

@techreport{caopulan-caopulan-email-notify-2026,
  author = {caopulan},
  title = {email-notify security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/caopulan-email-notify/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "email-notify security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "caopulan"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/caopulan-email-notify/audits/9"
identifiers:
  - type: other
    value: "skillstore:caopulan-email-notify:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Monitor Long Development Tasks

Receive an email when a long Codex implementation or test run finishes.

Track Remote Agent Runs

See completion status and project context without maintaining a terminal connection.

Report Automation Outcomes

Send concise success, failure, or blocked summaries after scheduled agent work.

Try These Prompts

Send a Basic Completion Email

Send a completion email for this finished task. Use title [title], status [status], and summary [summary]. Preview it before sending.

Use the Detected Project Name

Notify me that [task] finished with status [status]. Resolve the project name automatically and summarize the result without secrets.

Report a Failed Run

Send an email for the failed task [task]. State the failure status, summarize the cause, and list the next safe action.

Validate and Send a Team Notification

Prepare a completion notification for [task] and [project]. Dry-run it, verify recipients and transport security, then send after approval.

Best Practices

Run a dry preview before sending to new recipients or through a new SMTP server.
Keep task titles and summaries concise, accurate, and free of secrets.
Use SSL or STARTTLS whenever SMTP authentication is enabled.

Avoid

Do not place SMTP passwords in shared files, prompts, task summaries, or source control.
Do not send notifications to unverified recipient lists.
Do not disable transport encryption for authenticated internet SMTP servers.

Frequently Asked Questions

Which SMTP modes are supported?

The helper supports implicit SSL, STARTTLS, and plain SMTP. Authenticated connections should always use SSL or STARTTLS.

Can one notification reach multiple recipients?

Yes. Configure recipient addresses as a comma-separated or semicolon-separated list.

How is the project name selected?

An explicit argument has priority. Otherwise, the helper checks AGENTS.md and then uses the project directory name.

Can I preview a message without sending it?

Yes. The dry-run option prints connection details and message content without opening an SMTP connection.

Does the skill remove secrets from summaries?

No. Users and agents must exclude credentials, tokens, personal data, and other sensitive content.

Does the skill send notifications automatically?

No. An agent must invoke the helper after a task or follow a project instruction that requests notification.

Developer Details

Author

caopulan

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/caopulan/Notification-Skill/tree/main/email-notify

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

7 downloads · 207 views

File structure

📁 scripts/

📄 send_email_notification.py

📄 SKILL.md