Mailinator - Free, Disposable, Email

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Mailinator integration, but it needs review because it encourages handling sensitive email tokens and uses under-scoped credential and install guidance.

Use this only for isolated test inboxes and dummy accounts. Do not use public Mailinator inboxes or AI-assisted retrieval for real password resets, production verification links, personal data, or secrets. Prefer header-based API authentication, avoid `token=` URLs, protect or rotate any token that appeared in command history or logs, and pin or locally review the npm package version before running the CLI or MCP server.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILLS.md:154

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILLS.md, lines 154-159
Vulnerability Type: Unpinned npm dependency and remote package execution
Risk Level: Medium

Vulnerable Code

bash

# Global installation
npm install -g mailinator-cli

# Or use with npx (no install)
npx mailinator-cli inbox test public

Technical Analysis

The documented commands install or execute mailinator-cli without specifying an exact package version or verifying package integrity. The project contains no lockfile, checksum, provenance verification instructions, or bundled implementation that would bind execution to an audited artifact.

The npx command may download and execute the package resolved from the npm registry at invocation time. Similarly, global installation retrieves the package version selected by npm and may run package lifecycle scripts. Consequently, the effective executable payload can change after this Skill has been reviewed.

Global installation also unnecessarily broadens exposure by placing the package in the user's global Node.js environment rather than a constrained project or container.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or the relevant package publication process.
2. The attacker publishes a malicious package release under the expected package name.
3. A user follows the Skill documentation and runs npm install -g mailinator-cli or the unpinned npx mailinator-cli command.
4. npm resolves and downloads the attacker-controlled release.
5. Malicious lifecycle scripts or runtime code execute with the privileges of the invoking user.
6. That code can access resources available to the user, potentially including local configuration, environment variables, Mailinator credentials, and email data.

Impact Assessment

Successful exploitation permits arbitrary code execution under the account invoking npm. Potential access includes user-readab ...[truncated 459 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mailinator-cli to an exact, reviewed version rather than relying on the latest registry release.
• Provide and verify an integrity hash or trusted package provenance before execution.
• Include a lockfile where applicable and establish a controlled dependency-update review process.
• Avoid global installation; install the dependency in an isolated project, container, or other least-privilege environment.
• Replace unrestricted npx usage with a version-pinned command and disable automatic acceptance of unexpected package resolution where supported.
• Document that npm lifecycle scripts may execute during installation and recommend using an unprivileged account without unrelated secrets in its environment.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILLS.md:7

Finding

API Token Allowed in URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILLS.md, line 7
Vulnerability Type: Sensitive credential exposure through URL query strings
Risk Level: Medium

Vulnerable Code

text

Both Public and Private emails may be accessed via the MCP or API servers.

The credential-handling instruction immediately preceding that statement is:

text

Subscribers to the Mailinator service may provide their API token (via Auth header or token= query parameter) and access their private domains.

Technical Analysis

The Skill explicitly permits a Mailinator API token to be supplied through a token= URL query parameter. Query strings are commonly retained in browser history, command history, reverse-proxy and web-server access logs, observability platforms, debugging output, and copied URLs. Depending on client and redirect behavior, they may also be disclosed through referrer data.

API credentials are bearer secrets. Any party obtaining the URL can potentially reuse the token without possessing an additional authentication factor. Header-based authentication is already supported and is sufficient for the declared functionality, making query-string authentication an unnecessary expansion of credential exposure.

This risk is particularly significant because the token can grant access to private Mailinator domains and messages that may contain verification links, confirmation codes, or password-reset URLs.

Attack Path

1. A user follows the documentation and sends a Mailinator API request containing token=<secret> in its URL.
2. A browser, shell history, proxy, server, monitoring service, or verbose diagnostic facility records the complete URL.
3. An unauthorized person with access to that record extracts the bearer token.
4. The person submits authenticated requests to Mailinator using the disclosed token.
5. Subject to the token's assigned permissions, the person lists private inboxes and re ...[truncated 815 chars]

Remediation

View remediation

Remediation Suggestions

• Remove query-parameter authentication from the recommended configuration and require an authorization header.
• Clearly warn users never to place API tokens in URLs, command-line arguments, logs, prompts, or copied links.
• Ensure verbose and error output redacts authorization headers and any legacy token query parameter.
• Prevent credentials from being included in telemetry, proxy logs, cache keys, and diagnostic traces.
• Store tokens using a protected secret manager or environment injection mechanism with restrictive access.
• Apply least-privilege scopes to Mailinator tokens and rotate any token that may have appeared in a URL or log.
• Restrict access to private inboxes and avoid processing real production password-reset or verification messages through disposable-email workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill prominently describes Mailinator as suitable for testing and AI-assisted workflows but does not clearly warn that public @mailinator.com inboxes are readable by anyone. In this context, users may unintentionally expose verification emails, account links, or other sensitive content to the public service and then further propagate that data into AI tooling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILLS.md (reported line 97)May include surrounding context.

md

Mailinator inboxes and emails may be accessed via the api. Again, public inboxes and emails do not require an API key, private inboxes/email do.

Fetching an inbox:
GET https://api.mailinator.com/api/v3/domains/<domain>/inboxes/<inboxname>

where <domain> may be public, private, or a custom subscriber domain
<inboxname> must be alphanumeric from 1-50 characters, it may also be blank or contain wildcards for private domains

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILLS.md (reported line 103)May include surrounding context.

md

Mailinator inboxes and emails may be accessed via the api. Again, public inboxes and emails do not require an API key, private inboxes/email do.

Fetching an inbox:
GET https://api.mailinator.com/api/v3/domains/<domain>/inboxes/<inboxname>

where <domain> may be public, private, or a custom subscriber domain
<inboxname> must be alphanumeric from 1-50 characters, it may also be blank or contain wildcards for private domains

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILLS.md (reported line 268)May include surrounding context.

md

Mailinator inboxes and emails may be accessed via the api. Again, public inboxes and emails do not require an API key, private inboxes/email do.

Fetching an inbox:
GET https://api.mailinator.com/api/v3/domains/<domain>/inboxes/<inboxname>

where <domain> may be public, private, or a custom subscriber domain
<inboxname> must be alphanumeric from 1-50 characters, it may also be blank or contain wildcards for private domains

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The documentation recommends running the tool via npx mailinator-cli without pinning a specific package version. This allows whatever version is current at execution time to be fetched and run, creating a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example prompts encourage retrieving password reset emails and confirmation codes, which normalizes handling account-recovery material through a public/disposable inbox service and AI assistant context. Without warnings or safeguards, this increases the chance of credential exposure, takeover of test or real accounts, and unsafe treatment of sensitive tokens.

Content

No source excerpt is available for this finding.