T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create_inbox.py:34- Finding
Mailbox credentials are generated using a non-cryptographic pseudorandom generator
- Content
View full analysis
- Remediation
View remediation
Security audit
Disposable Email
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims for disposable Mail.tm testing inboxes, but its outputs can contain mailbox tokens, passwords, message bodies, and OTPs that users should treat as sensitive.
Use this skill only for disposable testing inboxes, not for important personal or production accounts. Treat the generated token, password, saved JSON, message bodies, OTPs, terminal output, and CI logs as sensitive, and delete saved result files when finished.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/e2e_otp.py:89- Finding
Mailbox tokens, passwords, OTPs, and message contents are exposed through unsafe interfaces
- Content
View full analysis
--list` - Read latest message: - `python3 scripts/read_inbox.py --token --latest` ``` `scripts/create_inbox.py:52-59` ```python print(json.dumps({ "address": canonical_address, "requestedAddress": requested_address, "password": password, "token": token_resp.get("token"), "accountId": account.get("id"), "domain": domain, }, ensure_ascii=False)) ``` `scripts/read_inbox.py:13,50` ```python req.add_header("Authorization", f"Bearer {token}") ``` ```python p.add_argument("--token", required=True, help="Mail.tm bearer token") ``` `scripts/e2e_otp.py:89-98` ```python p.add_argument("--save", help="Optional path to save final JSON result") args = p.parse_args() def emit(payload, flush=False): print(json.dumps(payload, ensure_ascii=False), flush=flush) if args.save: out_dir = os.path.dirname(os.path.abspath(args.save)) os.makedirs(out_dir, exist_ok=True) with open(args.save, "w", encoding="utf-8") as f: json.dump(payload, f, ensure_ascii=False, indent=2) ``` `scripts/e2e_otp.py:103,111-121` ```python emit({"event": "inbox_created", **inbox}, flush=True) if match: emit({"event": "otp_found", "otp": match.group(1), "message": detail, "inbox": inbox}) return emit({"event": "message_received_no_otp", "message": detail, "inbox": inbox}) return emit({"event": "timeout", "inbox": inbox}) ``` ### Technical Analysis The documented `--token` interface places a bearer tok ...[truncated 2972 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Notes - Free temp domains can be blocked by some production services. - Keep token private; treat it like mailbox access credentials. - Prefer stable paid inbox providers for CI if reliability is critical.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents and invokes bundled scripts that perform network access to Mail.tm and can persist results to disk, but it declares no explicit tool scope such as allowed tools or permissions. This creates an authorization gap: an agent or platform may permit broader file-write and network behavior than reviewers or policy expect, increasing the risk of misuse or over-privileged execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code posts the generated email address and password to a third-party service API and retrieves an authentication token, but the file contains no comment, docstring, or user-facing notice explaining that credentials are being sent over the network. For a code file, network transmission of account data should have some visible disclosure unless clearly documented as part of the skill's stated purpose, which is not evident in this file alone.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script prints the mailbox password and bearer token in plaintext JSON to stdout. In agent, CI, or multi-user environments, stdout is often logged, captured, or exposed to downstream tools, which can let anyone with log access take over the disposable inbox, read OTPs, or impersonate the session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script emits the full inbox object, which includes the disposable email address, password, bearer token, and later full message contents including OTPs. It also optionally persists the same data to disk via --save, creating unnecessary exposure through stdout logs, CI artifacts, shell history workflows, or local files that other users or processes may access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code performs network requests to a third-party mail service and then prints full message details, including email body content and extracted OTPs, to stdout. Although the script name and arguments suggest inbox access, the file contains no user-facing warning, confirmation, or comment disclosing that sensitive mailbox contents and one-time codes will be retrieved and exposed in output.
- Content