Temporam Temp Mail

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:50 AM UTC
• Version: 0.1.1

Overview

This temporary-email skill uses the Temporam API for the expected mailbox functions, but retrieved emails and verification codes should be treated as sensitive.

Install only in an isolated environment with a scoped TEMPORAM_API_KEY. Do not use it for sensitive, regulated, or personal communications unless you accept that email addresses, message metadata, and full message contents are handled through Temporam. Prefer pinned dependencies and add request timeouts before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:32

Finding

Unpinned Third-Party Dependencies Permit Mutable Supply-Chain Resolution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/client.py:20

Finding

Temporam Client Network Requests Have No Timeout

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: mcp_server.py:20

Finding

MCP Tools Perform Outbound Requests Without Timeouts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior does not accurately match the detected capabilities: the skill claims to generate random email addresses, but that capability appears not to be implemented, while domain-listing behavior is present but undocumented. This mismatch can mislead users and reviewers about what the skill actually does, undermining trust and making it harder to assess privacy and security impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README documents tools for listing and retrieving full email contents but does not warn users that these messages may contain sensitive data such as verification codes, account links, personal messages, or other private content. In a temp-mail skill, this omission increases the chance that operators will mishandle, log, or overexpose mailbox contents during automation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requires environment-variable access for TEMPORAM_API_KEY and makes outbound network requests, but it does not declare tool scope or permissions. This weakens least-privilege controls and can cause the skill to run with broader capabilities than users or the platform expect, increasing the chance of unintended secret exposure or unauthorized external communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends email addresses and retrieved email contents to a third-party service, but the description does not clearly warn users that this data leaves the local environment. Because email content can include verification codes, personal data, or sensitive links, lack of disclosure can lead to privacy violations and unsafe use in higher-sensitivity workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says the skill provides functionality for generating temporary email addresses, but the implemented tools only list domains, list emails, fetch email content, and fetch the latest email. No function creates, provisions, or returns a new temporary mailbox/address, so the advertised behavior is broader than the actual code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill sends user-supplied email addresses and retrieves email contents from a third-party service without any in-file disclosure, consent prompt, or data-handling notice. Because email metadata and message bodies can contain sensitive information, silently transmitting or fetching this data from an external provider creates privacy and compliance risk, especially if users assume processing is local or agent-confined.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mcp_server.py (reported line 10)May include surrounding context.

python

import string

class TemporamClient:
    BASE_URL = "https://api.temporam.com/v1"

    def __init__(self, api_key=None):
        self.api_key = api_key or os.environ.get("TEMPORAM_API_KEY")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/client.py (reported line 8)May include surrounding context.

python

import string

class TemporamClient:
    BASE_URL = "https://api.temporam.com/v1"

    def __init__(self, api_key=None):
        self.api_key = api_key or os.environ.get("TEMPORAM_API_KEY")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains changelog content in Chinese for multiple feature descriptions, but there is no indication that the skill is intentionally region-specific or that users can choose another language. Under the natural-language policy rule, forcing a specific language without opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documentation is presented entirely in Chinese, with no indication that users can choose another language or that the locale restriction is intentional and justified. The policy requires flagging language or locale constraints when a specific language is effectively imposed without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill's example prompts are written only in Chinese, which can imply a language expectation or default behavior without offering alternatives or stating that other languages are supported. Under the language/locale policy, skills should not force a specific language unless the constraint is documented and justified or the user is given a choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill's stated purpose is temporary email retrieval operations, but the code also depends on reading a bearer token from the process environment. While this may be operationally necessary for the API, credential access is not described in the manifest's purpose and constitutes an additional capability beyond the user-facing email functions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes temporary email generation and retrieval functions, but does not mention credential handling or access to host environment data. The code automatically reads TEMPORAM_API_KEY from the process environment, which is a broader capability than the user-facing purpose requires.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.