ClawHub
Back to skill

Security audit

temp-mail

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward temporary-email helper that only performs disclosed Vortex mailbox actions, with normal privacy and dependency hygiene caveats.

Install only for low-risk signup or testing workflows. Do not use it for sensitive personal, financial, production, account-recovery, or secret-bearing email because mailbox data is handled by a third-party hosted service. Double-check the address before using clear, since it empties that temporary mailbox.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.24.0
# rich is optional, not required for core functionality
Confidence
92% confidence
Finding
The dependency is specified with only a lower bound (httpx>=0.24.0), which allows future unreviewed versions to be installed. This creates supply-chain and stability risk because a later release could introduce breaking changes or a malicious/compromised package version without any explicit review or reproducible build control.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.