ClawHub
Back to skill

Security audit

AntiTempmail

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly sends user-provided email addresses to AntiTempMail to check for disposable addresses, which matches its stated purpose but carries normal privacy considerations.

Before installing, confirm you are comfortable sending submitted email addresses, especially bulk lists, to AntiTempMail and review any privacy, retention, consent, or vendor requirements for your use case. Prefer test data during evaluation and avoid storing the API key in shell profiles on shared machines.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This command explicitly transmits an email address to an external API endpoint. In this skill's context, that behavior is expected functionality rather than covert exfiltration, but it still creates a real privacy and data-sharing risk if users are not clearly informed that personal data is leaving their environment.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Check Single Email

bash
curl -X POST https://antitempmail.com/api/v1/email/check \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ANTITEMPMAIL_API_KEY" \
  -d '{"email": "test@tempmail.com"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example instructs users to send an email address to a third-party service during registration checks, but it does not explicitly warn that this discloses user personal data to an external processor. The skill also states later that requests are logged for security and analytics, which increases the privacy significance of the omission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The bulk workflow sends an entire list of email addresses to a third-party API without prominently warning about the privacy and compliance impact of transferring a dataset of personal information off-platform. Because this is bulk transmission, the exposure is larger and could affect many individuals at once if used without proper notice, legal basis, or vendor review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This bulk command uploads a full local email list to an external service, which materially increases the amount of personal data disclosed in one action. The skill does not place an explicit warning at the point of use, so operators may underestimate the sensitivity and compliance implications of sending a whole file to a third party.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
# Read emails from file (one per line)
EMAILS=$(cat email_list.txt | jq -R . | jq -s .)

curl -X POST https://antitempmail.com/api/v1/email/check/bulk \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ANTITEMPMAIL_API_KEY" \
  -d "{\"emails\": $EMAILS}" | \