BotEmail.ai - Free bot email

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:19 PM UTC
• Version: v1.0.7

Overview

The skill is a coherent bot-email integration, but it needs review because it handles verification codes and API keys while documenting destructive inbox actions and an unsafe dashboard URL pattern.

Install only if you are comfortable sending bot inbox contents, verification emails, and codes to BotEmail.ai. Treat the returned API key like a password, avoid sharing dashboard URLs that contain keys, do not use this for high-value or regulated accounts, and require explicit confirmation before deleting messages or clearing an inbox. Use the optional MCP server only from a pinned, reviewed commit in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: EXAMPLES.md:354
• Finding: Inbox API Key Exposed in a Dashboard URL Query String<![CDATA[ ## Vulnerability Details **File Location**: `EXAMPLES.md:354` **Vulnerability Type**: Sensitive credential exposure through a URL query string **Risk Level**: Medium ### Vulnerable Code ```javascript return { email: account.email, received: inbox.emails?.[0] || null, viewUrl: `https://botemail.ai/dashboard?email=${account.email}&key=${account.apiKey}` }; ``` ### Technical Analysis The example embeds the account API key directly in the `key` query parameter of a dashboard URL. Although the URL uses HTTPS, query parameters may still be retained or disclosed through: - Browser history and synchronized browsing data - Server, reverse-proxy, CDN, and application access logs - Monitoring and analytics systems - Screenshots, copied links, bookmarks, and support records - Referrer headers when the dashboard loads external resources or follows links - Local application telemetry The API key is used elsewhere as a bearer credential for authenticated inbox operations. Consequently, possession of the key may provide access to messages received by the associated bot address. These messages can include verification links, account confirmation tokens, or 2FA codes. Credential transmission in an `Authorization` header to the declared BotEmail API is necessary for authenticated inbox access. Embedding that credential in a dashboard URL is not necessary and exceeds secure minimum disclosure. ### Attack Path 1. A user follows the email-template testing example. 2. The function returns a dashboard URL containing both the inbox address and API key. 3. The user opens, copies, logs, bookmarks, or otherwise handles that URL. 4. A browser synchronization service, access log, analytics platform, external resource, or person with access to the URL obtains the query string. 5. The attacker extracts the `key` value. 6. The attacker submits the exposed value as a bearer credential to the BotEmail inbox API. 7. Subject to the API key's server-side permissions, the a ...[truncated 831 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the API key from all URL paths and query parameters. 2. Authenticate dashboard access through a secure server-side session established after explicit login. 3. If a credential must be submitted to initialize a session, use a non-persistent POST body and immediately exchange it for a short-lived, scoped session cookie. 4. Configure session cookies with `Secure`, `HttpOnly`, and an appropriate `SameSite` policy. 5. Do not store bearer credentials in browser history, local storage, analytics events, logs, or referrer-visible URLs. 6. Configure a restrictive `Referrer-Policy`, such as `no-referrer`, as defense in depth. 7. Use short-lived, dashboard-only access tokens if shareable dashboard links are required. Such tokens should be single-use or narrowly scoped and must not be reusable against the inbox API. 8. Redact credential-bearing values from application, proxy, CDN, and monitoring logs. 9. Rotate any API keys that may already have been exposed through generated dashboard URLs. 10. Replace the vulnerable return value with a credential-free dashboard URL, for example: ```javascript return { email: account.email, received: inbox.emails?.[0] || null, viewUrl: 'https://botemail.ai/dashboard' }; ``` ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:164
• Finding: Optional MCP Installation Uses an Unpinned Remote Repository and Dependency Graph<![CDATA[ ## Vulnerability Details **File Location**: `README.md:164-166` **Vulnerability Type**: Unpinned third-party code and dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/claw-silhouette/botemail-mcp-server.git cd botemail-mcp-server npm install ``` ### Technical Analysis The optional MCP setup clones the mutable default branch of a remote repository and then runs `npm install`. No reviewed commit, signed release, checksum, or immutable version is specified. This creates two mutable trust boundaries: 1. The remote repository's default branch can change after the Skill has been audited. 2. `npm install` can resolve an evolving dependency graph and execute package lifecycle scripts. If the repository, maintainer account, package registry entry, or transitive dependency is compromised, installation may execute attacker-controlled code. This behavior is not required for the Skill's core HTTP API functionality and should remain explicitly optional. The audit did not establish that the referenced repository or its dependencies are currently malicious. The finding concerns the unsafe installation pattern and the resulting supply-chain exposure. ### Attack Path 1. An attacker compromises the MCP repository, a maintainer account, a referenced npm package, or a transitive dependency. 2. The attacker introduces malicious JavaScript or an installation lifecycle script. 3. A user follows the documented optional setup and clones the repository's current default branch. 4. The user runs `npm install`. 5. npm resolves the dependency graph and may execute lifecycle scripts such as `preinstall`, `install`, or `postinstall`. 6. The malicious code executes with the operating-system privileges of the user performing the installation. 7. It may access files, environment variables, agent configuration, API credentials, or network resources available to that user. ### Impact Assessment Successful exploitation ca ...[truncated 691 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the MCP source to a reviewed, immutable commit hash or signed release tag. 2. Publish and document cryptographic checksums or signature-verification steps for release artifacts. 3. Commit a lockfile and use `npm ci` rather than unconstrained `npm install`. 4. Pin direct dependencies and review transitive dependency changes before release. 5. Run dependency auditing and provenance checks in CI. 6. Where compatible, install with lifecycle scripts disabled: ```bash npm ci --ignore-scripts ``` 7. If lifecycle scripts are required, document them and explain why each script is necessary. 8. Perform installation in an isolated, least-privileged environment without unrelated credentials. 9. Clearly state that MCP installation is optional and not required for direct HTTP API use. 10. Replace the mutable clone instructions with a pinned workflow, such as: ```bash git clone https://github.com/claw-silhouette/botemail-mcp-server.git cd botemail-mcp-server git checkout <reviewed-commit-hash> npm ci --ignore-scripts ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (38)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### GET /api/emails/{email}/{id}
Get a single email by ID.

### DELETE /api/emails/{email}/{id}
Delete a specific email.

### DELETE /api/emails/{email}

• Confidence: 85% confidence
• Finding: The documented delete-by-ID endpoint exposes a destructive capability over a user-controlled parameter without any stated confirmation, authorization scoping, or safety constraints beyond possession of the API key. In an agent workflow, this creates a realistic risk that prompt confusion, bad tool routing, or malicious instruction could cause deletion of messages that may contain important verification or audit information.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### DELETE /api/emails/{email}/{id}
Delete a specific email.

### DELETE /api/emails/{email}
Clear entire inbox.

---

• Confidence: 91% confidence
• Finding: The clear-entire-inbox endpoint is especially dangerous because a single request can irreversibly remove all stored messages, including verification codes, testing evidence, and notifications. In this skill context, where inboxes are used for automated workflows and authentication-related emails, accidental or manipulated invocation could disrupt accounts and destroy useful records at scale.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create random bot email (no username needed)
curl -X POST https://api.botemail.ai/api/create-account \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples display an API key and later demonstrate extracting verification codes, but the surrounding documentation does not prominently warn that these values grant mailbox access and can expose account verification flows. In agent or demo contexts, readers may copy logging patterns or share outputs, leading to credential leakage and unauthorized inbox access.

External Transmission

Medium

• Category: Data Exfiltration

Content

```javascript
async function autoVerifyEmail(serviceName) {
  // 1. Create bot email
  const accountResponse = await fetch('https://api.botemail.ai/api/create-account', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({})

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```javascript
async function autoVerifyEmail(serviceName) {
  // 1. Create bot email
  const accountResponse = await fetch('https://api.botemail.ai/api/create-account', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({})

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```javascript
async function autoVerifyEmail(serviceName) {
  // 1. Create bot email
  const accountResponse = await fetch('https://api.botemail.ai/api/create-account', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({})

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cleanup example performs permanent deletion of emails but does not clearly warn that the action is destructive and irreversible. Users may run it as-is against active inboxes and unintentionally destroy messages, including evidence, verification emails, or operational data.

External Transmission

Medium

• Category: Data Exfiltration

Content

});

// 2. Register webhook with BotEmail.ai
await fetch('https://api.botemail.ai/api/webhook/register', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.