macbird

The server explicitly warns about giving AI direct access to email, which is an inherent risk. A critical vulnerability exists in the `download_attachment` and `read_email_attachments` tools, where the `downloadPath` parameter is directly used to write files to the local filesystem without sufficient sanitization or validation. A malicious AI could instruct the server to write arbitrary files to sensitive system locations or overwrite user files, leading to remote code execution or data corruption. While the WebSocket server is local-only, this arbitrary file write capability makes it unsafe to use with untrusted AI.