Temporam Temp Mail

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:50 AM UTC
• Version: 0.1.1

Overview

This temporary-email skill uses the Temporam API for the expected mailbox functions, but retrieved emails and verification codes should be treated as sensitive.

Install only in an isolated environment with a scoped TEMPORAM_API_KEY. Do not use it for sensitive, regulated, or personal communications unless you accept that email addresses, message metadata, and full message contents are handled through Temporam. Prefer pinned dependencies and add request timeouts before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:32
• Finding: Unpinned Third-Party Dependencies Permit Mutable Supply-Chain Resolution<![CDATA[ ## Vulnerability Details **File Location**: `README.md:32-36` **Vulnerability Type**: Unpinned Python dependencies **Risk Level**: Medium ### Vulnerable Code ```bash ### Install dependencies pip install requests mcp ``` ### Technical Analysis The documented installation command installs `requests`, `mcp`, and their transitive dependencies without version constraints, a lockfile, or package hashes. Consequently, the code installed by users can change after this Skill has been reviewed. This does not demonstrate that either named package is currently malicious. However, it creates a supply-chain exposure: a compromised future release, compromised maintainer account, malicious transitive dependency, or unexpectedly incompatible update could enter the Skill's runtime without further review. ### Attack Path 1. An attacker compromises a named dependency or one of its transitive dependencies and publishes a malicious release to the configured Python package index. 2. A user follows the documented `pip install requests mcp` command. 3. `pip` resolves the current mutable release and installs the affected package. 4. The malicious package executes through installation hooks or when `mcp_server.py` imports the dependency. 5. The payload runs with the privileges of the user or service account installing or operating the Skill. ### Impact Assessment A successful dependency compromise could execute arbitrary code under the installing or runtime account. Depending on that account's permissions, this could expose environment variables such as `TEMPORAM_API_KEY`, retrieved email content, local files accessible to the process, or other credentials present in the runtime environment. The issue does not itself grant elevated operating-system privileges; its scope is bounded by the privileges and accessible data of the affected Python environment. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin direct dependencies to reviewed versions in a requirements or project configuration file. 2. Generate and commit a lockfile that includes all transitive dependencies. 3. Use package hashes, such as `pip install --require-hashes`, to verify downloaded artifacts. 4. Install dependencies from a trusted, explicitly configured package index. 5. Enable automated dependency vulnerability monitoring and review updates before merging them. 6. Run the Skill in an isolated virtual environment or container with only the environment variables and filesystem access required for temporary-email operations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/client.py:20
• Finding: Temporam Client Network Requests Have No Timeout<![CDATA[ ## Vulnerability Details **File Location**: `scripts/client.py:20` **Vulnerability Type**: Unbounded outbound network request **Risk Level**: Medium ### Vulnerable Code ```python response = requests.request(method, url, headers=self.headers, params=params, json=data) ``` ### Technical Analysis The shared `_make_request` method does not supply a `timeout` argument to `requests.request`. The Requests library therefore permits the connection or response read to wait indefinitely under some network conditions. Because every `TemporamClient` API operation uses this helper, a stalled API endpoint, disrupted connection, or upstream service that accepts a connection without completing its response can block all client operations that depend on it. The request sends the Temporam Bearer token only to the fixed HTTPS base URL, which is necessary for the declared functionality. No unrelated credential exfiltration was identified. The vulnerability is the absence of availability controls around that necessary network access. ### Attack Path 1. An agent invokes `get_domains`, `list_emails`, `get_email_detail`, or `get_latest_email`. 2. `_make_request` opens a connection to the configured Temporam API endpoint. 3. The upstream service or an adverse network condition prevents the response from completing. 4. Because no connect or read timeout is configured, the calling worker remains blocked. 5. Repeated concurrent invocations can consume available workers, threads, or process capacity and cause denial of service. ### Impact Assessment Exploitation can delay or prevent completion of temporary-mail operations and may exhaust application worker capacity when multiple requests stall. It does not directly provide filesystem access, code execution, credential access, or privilege escalation. The affected scope includes every operation implemented through `TemporamClient`. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Configure separate bounded connection and read timeouts: ```python response = requests.request( method, url, headers=self.headers, params=params, json=data, timeout=(5, 15), ) ``` 2. Use a `requests.Session` configured with retry behavior only for safe, idempotent operations. 3. Apply exponential backoff with a strict retry limit and random jitter. 4. Propagate a clear timeout error to the caller rather than retrying indefinitely. 5. Add tests for connection timeout, read timeout, malformed responses, and Temporam service unavailability. 6. Apply caller-level deadlines when the method is used in polling workflows. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: mcp_server.py:20
• Finding: MCP Tools Perform Outbound Requests Without Timeouts<![CDATA[ ## Vulnerability Details **File Location**: `mcp_server.py:20-51` **Vulnerability Type**: Unbounded outbound network requests in MCP tools **Risk Level**: Medium ### Vulnerable Code ```python @mcp.tool() def get_domains(): """Get a list of available email domains from Temporam.""" response = requests.get(f"{BASE_URL}/domains", headers=get_headers()) response.raise_for_status() data = response.json() if not data.get("error"): return [d["domain"] for d in data.get("data", [])] return [] @mcp.tool() def list_emails(email: str, page: int = 1, limit: int = 20): """List emails received by a specific email address.""" params = {"email": email, "page": page, "limit": limit} response = requests.get(f"{BASE_URL}/emails", headers=get_headers(), params=params) response.raise_for_status() data = response.json() if not data.get("error"): return data.get("data", []) return [] @mcp.tool() def get_email_content(email_id: str): """Get the full content of a specific email by its ID.""" response = requests.get(f"{BASE_URL}/emails/{email_id}", headers=get_headers()) response.raise_for_status() data = response.json() if not data.get("error"): return data.get("data", {}) return {} @mcp.tool() def get_latest_email(email: str): """Get the most recent email received by a specific email address, including full content.""" params = {"email": email} response = requests.get(f"{BASE_URL}/emails/latest", headers=get_headers(), params=params) ``` ### Technical Analysis All four MCP tools issue synchronous HTTP requests without a `timeout` value. A request that does not complete can therefore occupy an MCP execution worker indefinitely. The exposure is especially relevant to `get_latest_email`, which documentation recommends for polling. Repeated polling combined with stalled network calls can accumulate blocked executions and reduce or eliminate MCP server availabi ...[truncated 1132 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add bounded connection and read timeouts to every `requests.get` call: ```python response = requests.get( f"{BASE_URL}/domains", headers=get_headers(), timeout=(5, 15), ) ``` 2. Centralize outbound HTTP behavior in a shared helper or configured `requests.Session` so timeout enforcement cannot be omitted by individual tools. 3. Apply limited retries with exponential backoff only for transient failures. 4. Add MCP-level invocation deadlines and concurrency limits. 5. Rate-limit polling operations and recommend a minimum polling interval. 6. Catch `requests.exceptions.Timeout` and return a controlled tool error without exposing authorization headers or sensitive response content. 7. Add availability tests covering stalled connections, slow responses, and concurrent polling. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior does not accurately match the detected capabilities: the skill claims to generate random email addresses, but that capability appears not to be implemented, while domain-listing behavior is present but undocumented. This mismatch can mislead users and reviewers about what the skill actually does, undermining trust and making it harder to assess privacy and security impact.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README documents tools for listing and retrieving full email contents but does not warn users that these messages may contain sensitive data such as verification codes, account links, personal messages, or other private content. In a temp-mail skill, this omission increases the chance that operators will mishandle, log, or overexpose mailbox contents during automation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill requires environment-variable access for `TEMPORAM_API_KEY` and makes outbound network requests, but it does not declare tool scope or permissions. This weakens least-privilege controls and can cause the skill to run with broader capabilities than users or the platform expect, increasing the chance of unintended secret exposure or unauthorized external communication.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sends email addresses and retrieved email contents to a third-party service, but the description does not clearly warn users that this data leaves the local environment. Because email content can include verification codes, personal data, or sensitive links, lack of disclosure can lead to privacy violations and unsafe use in higher-sensitivity workflows.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest says the skill provides functionality for generating temporary email addresses, but the implemented tools only list domains, list emails, fetch email content, and fetch the latest email. No function creates, provisions, or returns a new temporary mailbox/address, so the advertised behavior is broader than the actual code.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill sends user-supplied email addresses and retrieves email contents from a third-party service without any in-file disclosure, consent prompt, or data-handling notice. Because email metadata and message bodies can contain sensitive information, silently transmitting or fetching this data from an external provider creates privacy and compliance risk, especially if users assume processing is local or agent-confined.

External Transmission

Medium

• Category: Data Exfiltration

Content

import string

class TemporamClient:
    BASE_URL = "https://api.temporam.com/v1"

    def __init__(self, api_key=None):
        self.api_key = api_key or os.environ.get("TEMPORAM_API_KEY")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import string

class TemporamClient:
    BASE_URL = "https://api.temporam.com/v1"

    def __init__(self, api_key=None):
        self.api_key = api_key or os.environ.get("TEMPORAM_API_KEY")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This markdown file contains changelog content in Chinese for multiple feature descriptions, but there is no indication that the skill is intentionally region-specific or that users can choose another language. Under the natural-language policy rule, forcing a specific language without opt-in is a policy concern.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The skill documentation is presented entirely in Chinese, with no indication that users can choose another language or that the locale restriction is intentional and justified. The policy requires flagging language or locale constraints when a specific language is effectively imposed without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The skill's example prompts are written only in Chinese, which can imply a language expectation or default behavior without offering alternatives or stating that other languages are supported. Under the language/locale policy, skills should not force a specific language unless the constraint is documented and justified or the user is given a choice.

Context-Inappropriate Capability

Low

• Confidence: 77% confidence
• Finding: The skill's stated purpose is temporary email retrieval operations, but the code also depends on reading a bearer token from the process environment. While this may be operationally necessary for the API, credential access is not described in the manifest's purpose and constitutes an additional capability beyond the user-facing email functions.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: The manifest describes temporary email generation and retrieval functions, but does not mention credential handling or access to host environment data. The code automatically reads TEMPORAM_API_KEY from the process environment, which is a broader capability than the user-facing purpose requires.

Static analysis

No suspicious patterns detected.