dropmail

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.3

Overview

The skill is a coherent disposable-email CLI that clearly discloses its third-party email service use and local mailbox/session storage, with only ordinary privacy and installation cautions.

Install it only if you are comfortable routing disposable-email traffic through GuerrillaMail and storing received messages plus mailbox session cookies under ~/.dropmail/. Do not use it for sensitive account recovery, financial, medical, or long-lived login flows, and prefer the user-local install unless you specifically need a system-wide command.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is an end-user feature for managing disposable email addresses via GuerrillaMail. The actual code does not create temp emails, interact with GuerrillaMail, fetch inboxes, or implement any email-management workflow. Instead, it contains security-focused unit tests for sanitizing attacker-controlled text rendered in a terminal. While such sanitization could be a supporting detail inside an email-reading tool, this specific chunk’s primary behavior is testing text-cleaning logic, not disposable email management. Therefore the code chunk does not accurately represent the declared skill description.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/dropmail.py (reported line 79)May include surrounding context.

python

"}

# Dangerous format (Cf) characters that are not caught by a "strip all Cc"
# rule because Unicode classes them as Cf, not Cc. Left-to-right / right-to-left
# overrides, embeddings, and isolates let a crafted message reorder how the
# terminal renders text (bidi spoofing, e.g. hiding a trailing command).
_BIDI = {
    "‎", "‏",                          # LRM / RLM
    "‪", "‫", "‬", "‭", "‮",  # LRE RLE PDF LRO RLO
    "⁦", "⁧", "⁨", "⁩",       # LRI RLI FSI PDI
}


def _valid_email(email: str) -> bool:
    return bool(email) and len(email) <= 254 and bool(_EMAIL_RE.match(email))


def _clean(text) -> str:
    """Strip terminal control/escape characters from server-supplied content.

    Inbox contents come from anyone who emails a disposable address, i.e. they
    are fully attacker-controlled. Printing them raw would let a crafted message
    inject escape sequences into the user's terminal (ANSI/OSC screen spoofing,
    clipboard/title manipulation) or reord

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

---
name: dropmail
description: Manage disposable email addresses using GuerrillaMail. Use when a user wants to create a temporary/throwaway email address, check a disposable inbox for messages, or avoid sharing their real email with untrusted services. Triggers on phrases like "temp email", "disposable email", "temporary email", "throwaway email", "create a burner email", or any dropmail command.
---

# DropMail Skill

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

For markdown files, SQP-2 applies when the skill description omits warnings about behaviors affecting user data or privacy. The README states that the skill creates disposable addresses via the GuerrillaMail API and stores mail locally, but it does not clearly disclose the privacy implication that emails and related session data are handled by an external provider.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md

# System-wide: install a root-owned COPY (not a symlink). A symlink from a
# root PATH into the skill directory would run whatever later lands there;
# a copy owned by root:root can only be changed by root.
sudo install -o root -g root -m 0755 <skill-dir>/scripts/dropmail.py /usr/local/bin/dropmail

# User-local: a symlink is fine here — ~/.local/bin and the skill directory
# are both controlled by the same (non-root) user.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

# System-wide: install a root-owned COPY (not a symlink). A symlink from a
# root PATH into the skill directory would run whatever later lands there;
# a copy owned by root:root can only be changed by root.
sudo install -o root -g root -m 0755 <skill-dir>/scripts/dropmail.py /usr/local/bin/dropmail

# User-local: a symlink is fine here — ~/.local/bin and the skill directory
# are both controlled by the same (non-root) user.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill metadata does not declare an explicit tool/permission scope, while the documented behavior clearly includes network access and local file writes, and also contradicts itself on environment-variable access. Missing scope declarations weaken reviewability and can let a caller invoke a skill with broader authority than users expect. The context makes this somewhat more concerning because the skill handles mailbox contents and session cookies, which are sensitive even if disposable.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill persists mailbox state and session cookies on disk, enabling continued access to disposable inboxes beyond a single invocation. If those local artifacts are exposed through backup leakage, local compromise, or misconfigured permissions, an attacker could read cached messages or hijack mailbox sessions. The context increases sensitivity because disposable inboxes commonly receive one-time codes and login links.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: dropmail
description: Manage disposable email addresses using GuerrillaMail. Use when a user wants to create a temporary/throwaway email address, check a disposable inbox for messages, or avoid sharing their real email with untrusted services. Triggers on the phrases "temp email", "disposable email", "temporary email", "throwaway email", or "create a burner email".
---

# DropMail Skill

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill transmits email data to an external third-party service, GuerrillaMail, including mailbox contents, subjects, senders, and message bodies. This is inherently privacy-sensitive because verification codes, login links, or other sensitive content could be exposed to the provider or intercepted if the external service is compromised. The context makes this more dangerous because the skill is explicitly intended for untrusted-service signups, where users may nonetheless route sensitive account flows through it.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Declared so its authority is reviewable before you run it — it does exactly this and no more:

- **Network:** HTTPS requests to `https://api.guerrillamail.com/ajax.php` only. No other host is contacted.
- **Filesystem:** reads and writes only under `~/.dropmail/` (the SQLite DB and `sessions.json`). Nothing else on disk is read or written.
- **No shell execution, no environment-variable reads, no credentials.** The skill runs no subprocesses and needs no API keys or secrets.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 3)May include surrounding context.

md

_SSL_CTX = _make_ssl_context()
API_BASE = "https://api.guerrillamail.com/ajax.php"
SESSION_FILE = DB_DIR / "sessions.json"

# Language sent to the GuerrillaMail API (affects returned welcome/excerpt text).

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/dropmail.py (reported line 59)May include surrounding context.

python

_SSL_CTX = _make_ssl_context()
API_BASE = "https://api.guerrillamail.com/ajax.php"
SESSION_FILE = DB_DIR / "sessions.json"

# Language sent to the GuerrillaMail API (affects returned welcome/excerpt text).

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/dropmail.py (reported line 121)May include surrounding context.

python

# ── Filesystem helpers ────────────────────────────────────────────────────────
def _ensure_private_dir():
    """Create ~/.dropmail owned by the user only (0700). Session cookies and
    cached inbox contents live here; other local users must not read them."""
    DB_DIR.mkdir(parents=True, exist_ok=True)
    try:

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation states there are no environment-variable reads, but later explicitly documents use of DROPMAIL_LANG. This inconsistency can mislead reviewers and users about data sources and runtime behavior, undermining trust in the declared security boundary. The practical impact is limited because the documented variable appears low sensitivity, but the mismatch signals weak security documentation hygiene.

Content

No source excerpt is available for this finding.