Mastodon Feed
jonny@neuromatch.social ("jonny (nonvenomous)") wrote:
one of the things that is available without any user approval is importing emails into gmail - https://github.com/sneakers-the-rat/muse-skills/blob/77754880226c2f93357176ca97f7d1152cb47a8a/skills/gmail/manifest.yaml#L198
Directly inserts a message into only this user's mailbox similar to IMAP APPEND, bypassing most scanning and classification.
So an attacker can just directly phish you into your inbox with an email that looks like it's coming directly from an official domain. awesome! I'll test this and update this post with the result once network egress is restored - it's been down for hours, not sure if just for me or across all muse instances.