Agent Burner

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:56 AM UTC
• Version: 0.2.1

Overview

This disposable email skill is coherent, but it steers agents to handle full email contents and verification/OTP-style messages through a third-party no-auth inbox service without enough privacy and account-safety warnings.

Review before installing. Use this only for low-sensitivity disposable email testing, not for account recovery, high-value logins, MFA/OTP messages, passwords, personal data, confidential business mail, or regulated information. Treat inbox keys like secrets, and prefer installing a pinned reviewed version rather than loading a mutable remote skill file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:18

Finding

Unpinned Third-Party Installation and Mutable Remote Skill Source

Content

View full analysis

Vulnerability Details

File Location: README.md:18-21
Vulnerability Type: Supply-chain risk from unpinned dependencies and mutable remote instructions
Risk Level: Medium

Vulnerable Code:

markdown

```bash
npx skills add jsemldonado/agent-burner

Or point your agent at agentburner.com/skill.md.

text

### Technical Analysis

The documented installation command invokes the `skills` package through `npx` without specifying a verified package version and imports `jsemldonado/agent-burner` without an immutable release or commit reference. Consequently, installation may resolve to upstream content that differs from the version reviewed during this audit.

The alternative recommendation loads Skill instructions from `https://agentburner.com/skill.md`, which is also a mutable external resource. Control of the hosting domain, server, repository, package, or relevant publisher account would permit an attacker to replace the expected content after this project has been reviewed.

This is a supply-chain weakness rather than evidence that the currently audited files contain a malicious payload. The repository itself contains only documentation files, and no embedded executable code was identified.

### Attack Path

1. An attacker compromises the npm package publisher, repository owner, distribution account, hosting server, or associated domain.
2. The attacker publishes a modified installer, Skill version, or hosted `skill.md`.
3. A user follows the README and either runs the unpinned `npx` installation command or points an agent at the mutable remote Skill file.
4. The client resolves and trusts the attacker-controlled upstream content because no immutable version, commit, signature, or integrity hash is required.
5. The modified package or Skill instructions execute or influence the agent within the permissions available to the installer or agent runti
...[truncated 538 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills installer package to a reviewed, exact version instead of allowing npx to resolve the current release dynamically.
• Pin the installed Skill to a signed release, immutable commit hash, or other content-addressed reference.
• Publish and verify cryptographic integrity hashes or signatures for distributed Skill files.
• Vendor the reviewed SKILL.md in the package rather than recommending that agents dynamically load instructions from a mutable website.
• If remote retrieval remains necessary, download the file as data, verify its signature or expected digest before use, and reject any mismatch.
• Document the expected publisher identity, version, commit, and integrity value so users can independently verify the installed artifact.
• Use a restricted installation and execution environment with minimal filesystem, credential, and network permissions to limit the consequences of an upstream compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

| `POST /inbox` | Create inbox (returns address, key, ttl) |
| `GET /inbox/:key` | List emails |
| `GET /inbox/:key/:id` | Full email with extracted URLs |
| `DELETE /inbox/:key` | Delete inbox (optional, auto-expires) |

No auth. Inboxes expire after 1 hour (max 6). URLs extracted automatically.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

- POST /inbox -> create inbox (returns address, key, ttl)
- GET /inbox/:key -> list emails (returns entries with id, from, subject)
- GET /inbox/:key/:emailId -> full email (returns body, html, urls[])
- DELETE /inbox/:key -> delete inbox

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · llms.txt (reported line 25)May include surrounding context.

text

- POST /inbox -> create inbox (returns address, key, ttl)
- GET /inbox/:key -> list emails (returns entries with id, from, subject)
- GET /inbox/:key/:emailId -> full email (returns body, html, urls[])
- DELETE /inbox/:key -> delete inbox

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This README promotes sending and retrieving email content through a third-party disposable inbox service but does not clearly warn that email bodies, metadata, and extracted URLs are transmitted to and processed by an external service. In agent workflows, users may forward verification links, secrets, or sensitive correspondence, so omission of a privacy/security warning materially increases the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

bash

# create an inbox
curl -X POST https://api.agentburner.com/inbox
# {"address":"[e-mail]","key":"550e8400-..."}

# read emails

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 11)May include surrounding context.

bash

# create an inbox
curl -X POST https://api.agentburner.com/inbox
# {"address":"[e-mail]","key":"550e8400-..."}

# read emails

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash

# create an inbox
curl -X POST https://api.agentburner.com/inbox
# {"address":"[e-mail]","key":"550e8400-..."}

# read emails

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 76% confidence

Finding

This endpoint retrieves full email bodies, HTML, and extracted URLs from a third-party service, which increases sensitivity compared with simply creating or listing an inbox. Because the README normalizes fetching and processing full message contents without warning, it creates a meaningful risk that agents or users will expose secrets, tracking links, or malicious content to an external processor.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

{"entries":[{"from":"...","subject":"...","id":"..."}]}

get full email

curl https://api.agentburner.com/inbox/550e8400-.../EMAIL_ID

{"body":"...","html":"...","urls":["..."]}

text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest says the skill should trigger for "any task requiring a throwaway email address," which is an open-ended condition rather than a tightly bounded invocation rule. This can cause unintended activation because it does not define scope limits, exclusions, or negative examples beyond a few sample phrases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill handles inherently sensitive content—email bodies, HTML, extracted URLs, and OTP/verification flows—yet provides no warning that messages are sent to and stored by a third-party disposable inbox service. Users may unknowingly route sensitive account recovery or verification emails through an ephemeral but externally controlled mailbox, increasing privacy and account-security risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This endpoint creates an inbox on an external service, causing user data and future inbound messages to be routed outside the local trust boundary. In the context of disposable email, that transmission is expected, but it is still security-relevant because it establishes third-party custody of potentially sensitive communications.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash

# create an inbox
curl -X POST https://api.agentburner.com/inbox
# -> { "address": "[e-mail]", "key": "550e8400-...", "ttl": 3600 }

# read emails

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Listing emails from the external inbox transmits the inbox key to a third-party API and reveals message metadata such as sender, subject, and receipt time. Because the inbox key is the sole credential, any exposure of that key can enable unauthorized mailbox access.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

# -> { "address": "[e-mail]", "key": "550e8400-...", "ttl": 3600 }

# read emails
curl https://api.agentburner.com/inbox/550e8400-...
# -> { "address": "...", "entries": [{ "id": "...", "from": "...", "subject": "...", "receivedAt": "..." }] }

# get full email

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

Fetching full email content from the external service can expose complete message bodies, raw HTML, and extracted URLs, which may include password resets, magic links, OTPs, or tracking content. In this skill's context, the danger is elevated because the documented purpose explicitly includes reading contents and extracting URLs from verification emails.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

# -> { "address": "...", "entries": [{ "id": "...", "from": "...", "subject": "...", "receivedAt": "..." }] }

# get full email
curl https://api.agentburner.com/inbox/550e8400-.../EMAIL_ID
# -> { "body": "...", "html": "...", "urls": ["..."], ... }

# delete inbox (optional -- auto-expires)

Static analysis

No suspicious patterns detected.