Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/cli.js:61
- Evidence
execFileSync(cfg.pythonExecutable || "python3", [
Security audit
Mailroom
Security checks across malware telemetry and agentic risk
Overview
Mailroom is a coherent email-routing and approval plugin, but it handles sensitive mailbox, agent-memory, and third-party model data that operators should configure deliberately.
Install only if you are comfortable letting this plugin read and persist Outlook message content and metadata, send selected email context to Gemini, send agent workspace/context/memory evidence to Anthropic during profile generation, and use Telegram as the human approval channel. Configure least-privilege Outlook/Maton access, keep API keys and the SQLite ledger protected, start in shadow mode, and verify the two-step approval flow before production use.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/outlook.js:32
- Evidence
const k = process.env.MATON_API_KEY;