Disposable Email

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:24 AM UTC
• Version: 1.0.3

Overview

This skill does what it claims for disposable Mail.tm testing inboxes, but its outputs can contain mailbox tokens, passwords, message bodies, and OTPs that users should treat as sensitive.

Use this skill only for disposable testing inboxes, not for important personal or production accounts. Treat the generated token, password, saved JSON, message bodies, OTPs, terminal output, and CI logs as sensitive, and delete saved result files when finished.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_inbox.py:34
• Finding: Mailbox credentials are generated using a non-cryptographic pseudorandom generator<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create_inbox.py:34-38,44-47`; `scripts/e2e_otp.py:37-41,47-50` **Vulnerability Type**: Predictable credential generation **Risk Level**: Medium ### Vulnerable Code `scripts/create_inbox.py:34-38,44-47` ```python def random_local_part(): word1 = random.choice(WORDS) word2 = random.choice(WORDS) digits = "".join(random.choices(string.digits, k=4)) return f"{word1}.{word2}.{digits}" domain = domains[0]["domain"] local = random_local_part() requested_address = f"{local}@{domain}" password = "Tmp!" + "".join(random.choices(string.ascii_letters + string.digits, k=12)) ``` `scripts/e2e_otp.py:37-41,47-50` ```python def random_local_part(): word1 = random.choice(WORDS) word2 = random.choice(WORDS) digits = "".join(random.choices(string.digits, k=4)) return f"{word1}.{word2}.{digits}" domain = domains[0]["domain"] local = random_local_part() requested_address = f"{local}@{domain}" password = "Tmp!" + "".join(random.choices(string.ascii_letters + string.digits, k=12)) ``` ### Technical Analysis Both scripts use Python's `random` module to generate mailbox passwords and address components. This module implements a deterministic pseudorandom number generator and is explicitly unsuitable for passwords, authentication tokens, or other security-sensitive values. If an attacker can recover or sufficiently constrain the generator state through another exposure in the same process or execution environment, subsequent values may be predictable. The generated password protects access to messages that may contain verification links and one-time passwords. The address also has limited entropy because it consists of two words from a fixed list and four decimal digits. Address predictability alone does not grant mailbox access, but it can make targeted account discovery easier. ### Attack Path 1. A victim runs `create_inbox.py` or `e2e_otp.py`, generating a mailbox password with ...[truncated 1139 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace all security-sensitive uses of `random` with Python's `secrets` module. - Generate passwords with sufficient entropy, for example: ```python import secrets import string alphabet = string.ascii_letters + string.digits password = "Tmp!" + "".join(secrets.choice(alphabet) for _ in range(20)) ``` - Use `secrets.choice()` for address components if address unpredictability is desired. - Alternatively, use `secrets.token_urlsafe()` to generate both the local address component and password. - Keep the address human-readable only if required; human-readable word lists reduce the address search space. - Add tests that prevent future credential-generation code from using `random`, timestamps, process identifiers, or other predictable values. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/e2e_otp.py:89
• Finding: Mailbox tokens, passwords, OTPs, and message contents are exposed through unsafe interfaces<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11-18,27-29`; `scripts/create_inbox.py:52-59`; `scripts/read_inbox.py:13,50`; `scripts/e2e_otp.py:89-98,103,111-121` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Code `SKILL.md:11-18` ```markdown - Create inbox + token: - `python3 scripts/create_inbox.py` - Returns JSON with `address`, `password`, `token`, `accountId`, `domain`. - List messages: - `python3 scripts/read_inbox.py --token <TOKEN> --list` - Read latest message: - `python3 scripts/read_inbox.py --token <TOKEN> --latest` ``` `scripts/create_inbox.py:52-59` ```python print(json.dumps({ "address": canonical_address, "requestedAddress": requested_address, "password": password, "token": token_resp.get("token"), "accountId": account.get("id"), "domain": domain, }, ensure_ascii=False)) ``` `scripts/read_inbox.py:13,50` ```python req.add_header("Authorization", f"Bearer {token}") ``` ```python p.add_argument("--token", required=True, help="Mail.tm bearer token") ``` `scripts/e2e_otp.py:89-98` ```python p.add_argument("--save", help="Optional path to save final JSON result") args = p.parse_args() def emit(payload, flush=False): print(json.dumps(payload, ensure_ascii=False), flush=flush) if args.save: out_dir = os.path.dirname(os.path.abspath(args.save)) os.makedirs(out_dir, exist_ok=True) with open(args.save, "w", encoding="utf-8") as f: json.dump(payload, f, ensure_ascii=False, indent=2) ``` `scripts/e2e_otp.py:103,111-121` ```python emit({"event": "inbox_created", **inbox}, flush=True) if match: emit({"event": "otp_found", "otp": match.group(1), "message": detail, "inbox": inbox}) return emit({"event": "message_received_no_otp", "message": detail, "inbox": inbox}) return emit({"event": "timeout", "inbox": inbox}) ``` ### Technical Analysis The documented `--token` interface places a bearer tok ...[truncated 2972 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Accept bearer tokens through standard input, a protected environment variable, or a descriptor-based secret mechanism instead of a command-line argument. - If environment variables are used, document that CI systems must mask the variable and avoid dumping the environment. - Do not print passwords or bearer tokens in normal output. Return only the generated address by default. - Provide an explicit, opt-in credential-output mode for workflows that require credentials, accompanied by a clear warning. - Remove the complete `inbox` object from `otp_found`, `message_received_no_otp`, and `timeout` events. - Return only the minimum required fields, such as the OTP, sender, subject, and timestamp. Include complete message bodies only when explicitly requested. - When persistence is requested, create the result file atomically with owner-only permissions such as mode `0600`. - Refuse unsafe destination types and avoid silently inheriting permissive permissions from an existing file. - Separate operational results from secrets so users can persist an OTP result without also persisting the mailbox password and bearer token. - Document token revocation or mailbox deletion procedures where supported by Mail.tm. - Ensure logs and CI artifacts redact `password`, `token`, `otp`, `text`, and `html` fields. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

## Notes

- Free temp domains can be blocked by some production services.
- Keep token private; treat it like mailbox access credentials.
- Prefer stable paid inbox providers for CI if reliability is critical.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents and invokes bundled scripts that perform network access to Mail.tm and can persist results to disk, but it declares no explicit tool scope such as allowed tools or permissions. This creates an authorization gap: an agent or platform may permit broader file-write and network behavior than reviewers or policy expect, increasing the risk of misuse or over-privileged execution.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code posts the generated email address and password to a third-party service API and retrieves an authentication token, but the file contains no comment, docstring, or user-facing notice explaining that credentials are being sent over the network. For a code file, network transmission of account data should have some visible disclosure unless clearly documented as part of the skill's stated purpose, which is not evident in this file alone.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script prints the mailbox password and bearer token in plaintext JSON to stdout. In agent, CI, or multi-user environments, stdout is often logged, captured, or exposed to downstream tools, which can let anyone with log access take over the disposable inbox, read OTPs, or impersonate the session.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script emits the full inbox object, which includes the disposable email address, password, bearer token, and later full message contents including OTPs. It also optionally persists the same data to disk via --save, creating unnecessary exposure through stdout logs, CI artifacts, shell history workflows, or local files that other users or processes may access.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This code performs network requests to a third-party mail service and then prints full message details, including email body content and extracted OTPs, to stdout. Although the script name and arguments suggest inbox access, the file contains no user-facing warning, confirmation, or comment disclosing that sensitive mailbox contents and one-time codes will be retrieved and exposed in output.

Static analysis

No suspicious patterns detected.