Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says, but it sends email addresses, bulk email lists, and full email headers to an external MailCheck API without a clear privacy warning or user confirmation.
Review before installing in any workplace or regulated environment. Use only with email addresses and headers you are allowed to send to MailCheck, prefer MAILCHECK_API_KEY over passing keys in commands, and avoid submitting sensitive full headers unless you have approval for third-party processing.
Raw email headers can contain sensitive metadata such as internal routing information, sender and recipient identifiers, mail infrastructure details, and organizational patterns. Sending those headers to an external API without strong disclosure and consent exposes potentially sensitive operational and personal data beyond the local environment.
The README instructs users to send email addresses to a third-party verification API but provides no privacy, consent, retention, or data-processing warning. Because email addresses are personal data in many contexts, this omission can lead to unintentional disclosure of user data to an external service and downstream compliance or trust issues.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const result = await fetch('https://api.mailcheck.dev/v1/verify', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.MAILCHECK_API_KEY}`,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const result = await fetch('https://api.mailcheck.dev/v1/verify', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.MAILCHECK_API_KEY}`,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const result = await fetch('https://api.mailcheck.dev/v1/verify', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.MAILCHECK_API_KEY}`,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const result = await fetch('https://api.mailcheck.dev/v1/verify', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.MAILCHECK_API_KEY}`,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const result = await fetch('https://api.mailcheck.dev/v1/verify', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.MAILCHECK_API_KEY}`,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const result = await fetch('https://api.mailcheck.dev/v1/verify', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.MAILCHECK_API_KEY}`,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests
resp = requests.post(
'https://api.mailcheck.dev/v1/verify',
headers={'Authorization': f'Bearer {API_KEY}'},
json={'email': 'user@example.com'}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests
resp = requests.post(
'https://api.mailcheck.dev/v1/verify',
headers={'Authorization': f'Bearer {API_KEY}'},
json={'email': 'user@example.com'}
The skill advertises functionality that necessarily uses environment access and outbound network access, but it does not declare any tool scope or permissions. That weakens user visibility and consent around what the skill can access and do, increasing the chance of unintended secret use or external data transmission.
The skill asks users to submit email addresses and raw email headers for verification and authenticity analysis, but it does not clearly warn that this data will be sent to an external third-party API. Email addresses and headers can contain sensitive personal, business, routing, and security metadata, so silent transmission creates privacy, compliance, and trust risks.
This network call performs external transmission of a user email address and an authorization token to a third-party service. In the context of a verification skill this is expected behavior, but it is still security-relevant because it exports potentially sensitive user data outside the host boundary.
}
try {
const response = await fetch('https://api.mailcheck.dev/v1/verify', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
This network call performs external transmission of a user email address and an authorization token to a third-party service. In the context of a verification skill this is expected behavior, but it is still security-relevant because it exports potentially sensitive user data outside the host boundary.
}
try {
const response = await fetch('https://api.mailcheck.dev/v1/verify', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
This command transmits user-supplied email addresses to a third-party API without any in-code disclosure, consent flow, or minimization controls. Email addresses are personal data in many environments, so silent external transfer can create privacy, compliance, and trust risks even if the feature is functionally intended.
This bulk endpoint sends multiple email addresses to an external API, making it a high-value data egress point. While the transmission is part of the advertised functionality, the volume possible in a single request increases privacy and governance risk if used without user awareness or policy controls.
}
try {
const response = await fetch('https://api.mailcheck.dev/v1/verify/bulk', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
This bulk endpoint sends multiple email addresses to an external API, making it a high-value data egress point. While the transmission is part of the advertised functionality, the volume possible in a single request increases privacy and governance risk if used without user awareness or policy controls.
}
try {
const response = await fetch('https://api.mailcheck.dev/v1/verify/bulk', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
The bulk verification command sends up to 100 email addresses to an external service in one request without any explicit warning or acknowledgment. This increases the privacy and compliance impact because larger datasets of personal information can be disclosed at once, magnifying harm from misuse or misconfiguration.
This call transmits complete email headers to an external analysis service, which is more sensitive than simple address verification because headers may reveal internal infrastructure and communication metadata. That makes the external transmission materially more dangerous in environments handling confidential or regulated email traffic.
}
try {
const response = await fetch('https://api.mailcheck.dev/v1/verify/auth', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
This call transmits complete email headers to an external analysis service, which is more sensitive than simple address verification because headers may reveal internal infrastructure and communication metadata. That makes the external transmission materially more dangerous in environments handling confidential or regulated email traffic.
}
try {
const response = await fetch('https://api.mailcheck.dev/v1/verify/auth', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
The guidance recommends storing the API key in an environment variable but does not warn users to protect that credential or avoid exposing it in examples, logs, shell history, or shared environments. While common, this omission can lead to accidental credential disclosure and unauthorized API use.
Detected: suspicious.env_credential_access