Agent Burner

Disposable email API. Use when you need a temporary email address -- receiving mail, reading contents, extracting URLs. Triggers include "create a temp email...

Security Scan

The skill's declared purpose (a no-auth disposable email API) matches its instructions and requirements — it calls a public REST API, requires no credentials or installs, and does not ask for unrelated access.

Purpose & Capability

Name/description describe a disposable email service and the SKILL.md only documents using https://api.agentburner.com endpoints to create/list/read/delete inboxes. There are no unexpected environment variables, binaries, or install steps required that would contradict the stated purpose.

Instruction Scope

Runtime instructions are limited to calling the service's REST endpoints and parsing returned fields (address, key, entries, urls, body, html). The SKILL.md does not instruct the agent to read local files, other env vars, or transmit data to unrelated endpoints.

Install Mechanism

No install spec and no code files — instruction-only skill. No downloads, no archive extraction, no third-party package installs. Lowest-risk install posture for a skill.

Credentials

The skill requests no environment variables, credentials, or config paths. The only credential concept is the inbox key returned by the API, which is consistent with the described service.

Persistence & Privilege

Skill is not always-enabled and uses default agent invocation settings. It does not request persistent system-wide configuration or modify other skills' settings.

Assessment

This skill is coherent with its description, but consider these practical risks before installing: the agent will call a third-party API (api.agentburner.com) and any email content retrieved via that API will be processed by your agent — do not use it for sensitive inboxes or verification codes you care about unless you trust the provider. Because inbox keys grant access to received mail, treat keys as secrets in your workflows. Also note the service is public/no-auth; anyone with a key or the created address could access messages until the inbox expires. If you need stronger guarantees (auditability, retention, privacy), use a vetted paid provider or your own controlled service.

Disposable email API. No signup, no API key.

Quick Start

# create an inbox
curl -X POST https://api.agentburner.com/inbox
# -> { "address": "[e-mail]", "key": "550e8400-...", "ttl": 3600 }

# read emails
curl https://api.agentburner.com/inbox/550e8400-...
# -> { "address": "...", "entries": [{ "id": "...", "from": "...", "subject": "...", "receivedAt": "..." }] }

# get full email
curl https://api.agentburner.com/inbox/550e8400-.../EMAIL_ID
# -> { "body": "...", "html": "...", "urls": ["..."], ... }

# delete inbox (optional -- auto-expires)
curl -X DELETE https://api.agentburner.com/inbox/550e8400-...

API Reference

POST /inbox

Create a disposable inbox.

Body (optional): { "ttl": 60 }   // TTL in minutes, default 60, max 360
Response: { "address": string, "key": string, "ttl": number }

• address -- the email address
• key -- inbox key (UUID), the only credential you need
• ttl -- inbox lifetime in seconds

Rate limited to 10 creations per minute per IP.

GET /inbox/:key

List received emails.

Response: { "address": string, "entries": [{ "id": string, "from": string, "subject": string, "receivedAt": string }] }

Returns 404 if key is expired or invalid.

GET /inbox/:key/:emailId

Get full email content.

Response: {
  "id": string,
  "from": string,
  "to": string[],
  "subject": string,
  "body": string,        // plain text
  "html": string | null, // raw HTML if present
  "urls": string[],      // all extracted URLs
  "receivedAt": string   // ISO 8601
}

DELETE /inbox/:key

Delete inbox and all emails. Optional -- inboxes auto-expire.

Response: { "ok": true }

Key Details

• No auth required -- inbox key is the only credential
• Multiple trusted .com domains
• Auto-expiry -- 1 hour default, 6 hours max
• 50 emails per inbox (oldest dropped first)
• 10MB max email size
• URLs extracted from both HTML and plain text

Errors

Status	Meaning
404	Key expired or invalid
429	Rate limit exceeded