Email Url Validator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:31 AM UTC
• Version: 1.0.2

Overview

The skill is a real email and URL validator, but it needs review because some workflows can send large contact or URL files to a third-party service before users clearly approve the data transfer.

Install only if you are comfortable sending email addresses, URLs, domains, and possibly entire spreadsheets to the hosted operator. For contact databases or private URL lists, require approval before any network request, remove unrelated columns locally, avoid arbitrary webhook URLs unless you control the destination, and consider self-hosting for sensitive or regulated data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:118

Finding

Sensitive File Contents Are Transmitted Before User Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:118, SKILL.md:358-367, SKILL.md:596
Vulnerability Type: Consent-flow privacy violation and premature transmission of sensitive data
Risk Level: Medium

Vulnerable Documentation

The documented policy states:

text

Bulk file uploads containing sensitive data (email lists, contact databases):
always use human-assisted mode regardless of pipeline context. Call with
confirmed=false first, show the item count and total cost, and require explicit
user approval before transmitting the file.

However, the documented quote workflow uses a multipart upload of the complete file:

bash

curl -s -X POST "https://deep-validator-production.up.railway.app/validate/emails/file" \
  -H "Authorization: Bearer <nvm-access-token>" \
  -F "file=@contacts.xlsx" \
  --output results.csv

The endpoint documentation further states that confirmed=false causes the remote service to parse the uploaded file:

text

confirmed=false ... parses the file, counts rows, returns a cost quote — no credits consumed.

The agent rules repeat the conflicting consent requirement:

text

For bulk file uploads or any operation involving sensitive personal data
(email lists, contact databases), always show the item count and cost estimate
and require explicit user approval before transmitting data.

Technical Analysis

The consent gate protects against billing but does not protect against data disclosure. To obtain the prescribed quote, the agent must send the complete multipart file to the externally operated Railway endpoint. The remote service necessarily receives and parses the file before returning its row count and cost estimate.

Consequently, confirmed=false means only that credits are not consumed. It does not mean that the data remains local. This directly conflicts with the instruction to obtain approval before transmitting sensitive data.

The uploaded tabular file may contain more than ...[truncated 2032 chars]

Remediation

View remediation

Remediation Suggestions

1. Perform quote preparation locally

   • Count rows locally without uploading the file.
   • Detect the relevant email or URL column locally.
   • Calculate the quote using the documented per-item price.

2. Obtain consent before network transmission

   • Clearly identify the third-party service and operator.
   • State exactly which fields will be transmitted.
   • Obtain explicit approval before uploading any file contents.

3. Minimize transmitted data

   • Extract only the selected email or URL column.
   • Remove names, telephone numbers, notes, identifiers, and unrelated columns.
   • Deduplicate entries locally where appropriate.
   • Avoid uploading the original workbook when a minimized list is sufficient.

4. Separate billing consent from privacy consent

   • Explain that confirmed=false prevents charging but does not prevent data transmission.
   • Require data-transmission approval before the quote request and billing approval before confirmed=true.

5. Provide a metadata-only quote endpoint

   • Allow clients to submit only an item count and operation type.
   • Do not require file contents for price calculation.
   • Cryptographically bind the quote to the count if billing integrity is required.

6. Improve documentation

   • Remove the contradictory instruction to upload first and consent later.
   • Explicitly document that the hosted service receives files sent with confirmed=false.
   • Distinguish local preprocessing, external disclosure, and paid validation as separate stages.

7. Add privacy-preserving alternatives

   • Support local validation for syntactic checks and classification.
   • Permit self-hosting for sensitive datasets.
   • Publish verifiable retention, deletion, encryption, access-control, and audit-log policies for the hosted service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 100)May include surrounding context.

| DEEP_VALIDATOR_API_KEY | No | Optional admin bypass key. If set, the operator can call the API directly without x402. Leave empty to enforce the Nevermined flow for all requests. |

bash

cp .env.example .env
# Set all four variables above in .env

pip install -r requirements.txt

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

bash

cp .env.example .env
# Set all four variables above in .env

pip install -r requirements.txt
uvicorn app.main:app --reload

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 600)May include surrounding context.

md

1. **Use `recommended_action` directly** — do not re-interpret `checks` or `risk_flags` to make a decision. The field summarises all signals into a single actionable value.
2. **Always surface `typo_suggestion`** when non-null — ask the user "Did you mean X?" before discarding the address. Never silently skip it.
3. **Large lists: classify first** — call `POST /batch/classify/emails` or `POST /batch/classify/urls` (free, no auth) to triage before spending credits. Only send `needs_check` and `looks_good` items to full validation.
4. **Never expose the Nevermined access token** (`Authorization: Bearer <token>`) in any message, log, or tool output shown to the user.
5. **HTTP 429** → tell the user "Rate limit reached" and wait 10 seconds before one retry.
6. **HTTP 402** → tell the user "Insufficient Nevermined credits" and do not retry.
7. **`recommended_action: block`** → do not use the address/URL. Explain the `action_reason` to the user.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly encourages sending emails, URLs, and very large uploaded files to a third-party hosted service, but it does not provide any clear privacy, retention, processing, or data-sharing warning. In an agent setting, this can cause sensitive user data to be transmitted off-platform without informed consent or policy checks, creating privacy, compliance, and data governance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The 'Invoke whenever email or URL validation would improve the quality of the agent's output' instruction is broad and followed by common phrases like 'Does this link work' and 'Clean / validate this list'. It does not define negative examples or tighter scope boundaries, which increases the chance of unintended invocation in ordinary conversation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This endpoint sends user-supplied email addresses to an external hosted service. Although the skill discloses this behavior and includes a quote/confirmation flow, email addresses are personal data and their transmission to a third-party operator introduces privacy, compliance, and trust risks if agents invoke it without strong consent handling.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

bash

# Step 1 — get a free cost quote (no auth required, confirmed=false by default)
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/email" \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "confirmed": false}'
# → HTTP 200: {"confirmed_required":true,"item_count":1,"cost_per_item":0.0001,"total_cost":0.0001,"currency":"USD","message":"...Resend with confirmed=true to proceed."}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This endpoint transmits URLs to an external service for live validation. While less sensitive than credentials, URLs can contain private paths, tokens, internal references, or user-specific identifiers, so forwarding them to a third party can expose confidential information.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

bash

# Step 1 — free cost quote (confirmed=false, no auth)
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/url" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "confirmed": false}'
# → HTTP 200: cost quote

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

Bulk email validation sends entire email lists to an external service, materially increasing privacy and regulatory exposure compared with single-item validation. In this skill context, the danger is elevated because the feature is designed for large contact databases, which may contain sensitive personal data at scale.

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

bash

# Step 1 — free quote for N emails (confirmed=false, no auth)
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/emails/bulk" \
  -H "Content-Type: application/json" \
  -d '{"emails": ["[e-mail]", "[e-mail]"], "confirmed": false}'
# → HTTP 200: {"item_count":2,"total_cost":0.0002,...}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

Bulk URL validation transmits potentially large sets of URLs to a third-party service. In enterprise or private workflows, these URLs may reveal internal research, customer data references, unpublished resources, or sensitive tokens, making the external transfer security-relevant.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

bash

# Step 1 — free quote (confirmed=false, no auth)
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/urls/bulk" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["https://example.com", "https://example.org"], "confirmed": false}'
# → HTTP 200: {"item_count":2,"total_cost":0.0002,...}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

Domain validation sends queried domains to an external operator. This is usually lower sensitivity than full email or URL submission, but domains under investigation can still reveal confidential business intent, vendor due diligence, or internal targets.

Content

Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.

bash

# Step 1 — free quote
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/domain" \
  -H "Content-Type: application/json" \
  -d '{"domain": "acme.io", "confirmed": false}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Even the free classify endpoints transmit batches of emails or URLs to an external service. Because the endpoint is positioned as no-auth and no-cost, agents may be more likely to invoke it casually, increasing the chance of unnecessary disclosure of user data.

Content

Scanner excerpt · SKILL.md (reported line 524)May include surrounding context.

bash

# Classify emails
curl -s -X POST "https://deep-validator-production.up.railway.app/batch/classify/emails" \
  -H "Content-Type: application/json" \
  -d '{"items": ["[e-mail]", "[e-mail]", "[e-mail]", "notanemail"]}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The rules prescribe exact English phrases for user communication: 'Rate limit reached' and 'Insufficient Nevermined credits'. This imposes a specific language on the user-facing output without opt-in or documented locale justification, which conflicts with language/locale policy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs agents to attach arbitrary webhook URLs for async jobs, including file-processing workflows that may involve contact lists or other sensitive user data, but the endpoint specifications never clearly define or constrain this behavior. That mismatch can cause agents to transmit job metadata or results to untrusted third-party endpoints without explicit user understanding, creating a data exfiltration and confused-deputy risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill encourages use of arbitrary external webhooks for completion notifications in async file workflows, including examples involving uploaded contact files. Even if only job status is posted, this still leaks workflow metadata to external destinations chosen at runtime, and if implementations drift, it can expand to sensitive result disclosure without clear consent boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.