Security audit

Email OTP

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it persistently stores and prints sensitive OTP, verification-link, password, and token data with under-disclosed security tradeoffs and imperfect file permission handling.

Review before installing. Use this only for low-stakes disposable email workflows, avoid routing important account recovery or personal data through it, and delete ~/.tempmail_otp/ after use. Be aware that OTPs, verification links, the mailbox password, and JWT token may remain in plaintext files and terminal output.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tempmail_otp.py:40
Finding: Sensitive state files are created with insufficient permission controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 127)May include surrounding context.
Reset all state:

bash
rm -rf ~/.tempmail_otp/

OTP Detection Patterns

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
Reset all state:

bash
rm -rf ~/.tempmail_otp/

OTP Detection Patterns

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 127)May include surrounding context.
Reset all state:

bash
rm -rf ~/.tempmail_otp/

OTP Detection Patterns

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
Reset all state:

bash
rm -rf ~/.tempmail_otp/

OTP Detection Patterns

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
python3 scripts/tempmail_otp.py create

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
3. **Cross-session persistence** - Works from any directory on your system 4. **Permission safety** - Sensitive credentials have proper file permissions To reset all state: `rm -rf ~/.tempmail_otp/` ## Typical Workflow

Session Persistence

Medium

Category: Rogue Agent
Confidence: 72% confidence
Finding: The quick-start flow normalizes automatic saving of OTPs to disk, which creates session persistence for one-time authentication material without emphasizing the security tradeoff. OTPs are highly sensitive, and persisting them beyond immediate use increases the window in which another local process or user could recover and misuse them.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
Quick Start

bash
# Create a new temporary email python3 scripts/tempmail_otp.py create # Use the displayed email for signup, then monitor for OTP

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly states that account credentials, JWT tokens, OTPs, and extracted links are persisted under ~/.tempmail_otp/, but it does not clearly warn users that these artifacts are sensitive and may enable session reuse or account takeover if exposed. Even with 0600 permissions, local compromise, backups, shell history, or multi-user misconfiguration can leak this data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill describes capabilities that involve file reads/writes, shell execution, and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it easier for an agent runtime to grant broader access than the skill actually needs, increasing the blast radius if the skill is misused or compromised.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill is intentionally designed for cross-session persistence by storing temporary email account state, credentials, and extracted authentication data under a user home directory. While functional, this creates a retention risk because sensitive registration artifacts remain available beyond the immediate task and may be reused, exfiltrated, or accidentally shared.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: email-otp description: Create temporary email addresses and monitor for registration OTP codes or validation links version: 1.0.0 metadata: author: etopro

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly states that it extracts OTPs, validation links, and stores account credentials and JWT tokens persistently, but it does not provide a clear warning that these are sensitive authentication artifacts. OTPs and session credentials can enable account takeover or unauthorized verification if exposed to other local processes, users, logs, or backups.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/tempmail_otp.py (reported line 11)May include surrounding context.
python
API: https://api.mail.tm Usage: tempmail_otp.py create [-d DOMAIN] [-e EMAIL] [-p PASSWORD] tempmail_otp.py check [--timeout SECONDS] [--poll SECONDS] [--sender SENDER] [--subject SUBJECT] tempmail_otp.py list tempmail_otp.py domains

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script stores the full temporary mailbox state locally, including the mailbox password and bearer token, and also prints credentials to stdout in normal operation. Even for a temp mailbox, these secrets grant access to inbox contents and any OTPs or account-verification links sent there, so other local users, shell history/logging systems, or downstream tooling may capture them.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:156

Overview

A.I.G

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

OTP Detection Patterns

Tool Parameter Abuse

OTP Detection Patterns

Tool Parameter Abuse

OTP Detection Patterns

Tool Parameter Abuse

OTP Detection Patterns

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Tool Parameter Abuse

Session Persistence

Quick Start

Missing User Warnings

Undeclared Tool Scope

Session Persistence

Missing User Warnings

Session Persistence

Description-Behavior Mismatch

Static analysis

File appears to expose a hardcoded API secret or token.