Mailtap

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:22 PM UTC
• Version: 1.0.4

Overview

The skill is transparent about using MailTap, but it encourages automated handling of verification emails and public attachments through unauthenticated temporary mailboxes.

Install only for low-risk testing or disposable workflows. Do not use it for password resets, financial accounts, identity checks, wallet recovery, privileged account creation, or anything where a verification code or email link could grant meaningful access. Treat all MailTap inboxes and attachments as public and untrusted, and download attachments only into a controlled sandbox after explicit review.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20
• Finding: Unauthenticated Public Access to Sensitive Temporary-Mailbox Contents<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-55`, `SKILL.md:252-258`, `openapi.json:69-107`, `openapi.json:155-226` **Vulnerability Type**: Unauthenticated exposure of email messages, verification codes, links, and attachment identifiers **Risk Level**: High ### Vulnerable Code and Configuration ```markdown No authentication or API key is required — all endpoints are public and use simple HTTP GET requests. This skill does not store, proxy, or modify any email data. All operations communicate directly with the official MailTap public API. **Ideal for AI agents performing tasks such as:** - Registering on websites/services without exposing real email addresses - Capturing verification codes, one-time links, or confirmation emails - Automating web3 airdrops, form submissions, or testing flows that require email verification - Privacy-focused workflows where email traceability must be avoided - Downloading email attachments when available **Base URL:** `https://api.mailtap.org` All responses are returned in JSON format. ## Core Capabilities The skill exposes three primary endpoints: 1. **Generate** a new temporary email address 2. **Retrieve** details of an existing email address 3. **Fetch** all messages in the inbox (including attachments metadata) Agents can chain operations autonomously (generate → wait → poll inbox → extract data → download attachments). ## Usage Guide for Agents Agents should use standard HTTP tools (`curl`, `fetch`, `requests`, etc.) to interact with the API. ### 1. Generate New Temporary Email ```bash curl "https://api.mailtap.org/public/generate" ``` ### 2. Get Email Details ```bash curl "https://api.mailtap.org/public/email/{address}" ``` ### 3. Get Inbox Messages ```bash curl "https://api.mailtap.org/public/inbox/{address}" ``` ``` The security limitations are explicitly documented as follows: ```markdown ## Important Notes & Limitations - Emails expire automatically after **30 minutes**. - Atta ...[truncated 3904 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require a cryptographically random mailbox access token separate from the email address. 2. Require that token on `/public/email/{address}` and `/public/inbox/{address}` requests. 3. Use authenticated, short-lived, signed URLs for attachments rather than permanently public object keys. 4. Ensure attachment URLs are scoped to one object, expire quickly, and cannot be enumerated. 5. Avoid placing mailbox addresses in logs, analytics, URLs exposed to unrelated systems, or agent-visible output unless required. 6. Add a prominent warning that temporary public mailboxes must not be used for password resets, financial accounts, wallet recovery, privileged account creation, or other high-impact authentication flows. 7. Redact verification codes, one-time links, and sensitive message bodies from diagnostic logs. 8. Apply rate limiting and abuse monitoring to inbox lookups, while recognizing that rate limiting is not a substitute for authorization. 9. If the external service cannot support mailbox authentication, constrain the Skill to low-risk testing workflows and require explicit user confirmation before using it for real account verification. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:171
• Finding: Attachment Validation Can Be Bypassed and Download Paths Are Not Sandboxed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:130-139`, `SKILL.md:171-217`, `SKILL.md:238-251` **Vulnerability Type**: Unsafe attachment trust and unrestricted local file destination **Risk Level**: Medium ### Vulnerable Code ```python # Whitelisted attachment types for security WHITELISTED_MIME_TYPES = { "application/pdf", "image/jpeg", "image/png", "image/gif", "text/plain", "text/csv", "text/html", "application/msword", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" } MAX_FILE_SIZE_MB = 10 # Maximum 10MB for security ``` ```python def download_attachment(r2_key: str, save_path: Optional[str] = None) -> str: """Downloads an attachment from the mailtap S3 storage with security checks.""" # Parse attachment info from r2_key parts = r2_key.split("/") if len(parts) < 2: raise ValueError("Invalid r2_key format") filename = parts[-1] if not filename or ".." in filename: raise ValueError("Invalid filename detected") url = f"{ATTACHMENT_BASE}/{r2_key}" # Get attachment metadata first response = requests.head(url, allow_redirects=True) response.raise_for_status() # Validate content type and size content_type = response.headers.get("content-type", "") content_length = response.headers.get("content-length") if content_type not in WHITELISTED_MIME_TYPES: raise ValueError(f"Unsafe MIME type: {content_type}") if content_length: size_mb = int(content_length) / (1024 * 1024) if size_mb > MAX_FILE_SIZE_MB: raise ValueError(f"File too large: {size_mb:.1f}MB (max {MAX_FILE_SIZE_MB}MB)") # Download the file response = requests.get(url, stream=True) response.raise_for_status() if save_path is None: save_path = filename # Ensure sa ...[truncated 4142 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store all downloads beneath a fixed, dedicated sandbox directory. 2. Generate local filenames rather than trusting remote names or arbitrary output paths. 3. If caller-selected relative paths are necessary, resolve both the sandbox root and destination and enforce containment with `destination.relative_to(sandbox_root)`. 4. Reject absolute paths, traversal components, symbolic-link destinations, and existing files. 5. Open files with exclusive creation semantics where possible to prevent unintended overwrites. 6. Validate the `GET` response itself rather than relying on a preceding `HEAD` response. 7. Enforce the size limit while streaming by counting bytes and aborting immediately when the configured maximum is exceeded. 8. Validate file signatures or parse content with a hardened format detector; do not rely solely on `Content-Type` or filename extensions. 9. Remove active formats such as HTML and macro-capable Office documents from the safe allowlist, or convert them to inert representations in an isolated environment. 10. Validate redirect destinations on every request and restrict final hosts to an explicit trusted-host allowlist. 11. Save untrusted files with non-executable permissions and process them only in a sandbox without credentials, network access, or access to sensitive files. 12. Scan attachments with appropriate malware and document-analysis tooling before previewing or parsing them. 13. Make downstream processing opt-in and require explicit user confirmation for untrusted attachments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Generate New Temporary Email

```bash
curl "https://api.mailtap.org/public/generate"
```

**Example response:**

• Confidence: 92% confidence
• Finding: The skill instructs agents to send data to an external third-party service to generate disposable email addresses and receive inbox contents. This is a genuine external transmission risk because any identifiers, verification messages, and attachments handled through the API are exposed to infrastructure outside the local trust boundary, and the skill explicitly promotes privacy-evasion and signup automation use cases.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2. Get Email Details

```bash
curl "https://api.mailtap.org/public/email/{address}"
```

### 3. Get Inbox Messages

• Confidence: 91% confidence
• Finding: Fetching email details from a public temp-mail API is a true external data exposure concern because the queried address and associated mailbox metadata are sent to a third-party endpoint. In this context, the skill is designed to facilitate account verification and anonymity, which increases the chance that sensitive verification flows or tokens will be routed through an untrusted service.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 3. Get Inbox Messages

```bash
curl "https://api.mailtap.org/public/inbox/{address}"
```

**Example response with attachment:**

• Confidence: 95% confidence
• Finding: Retrieving inbox messages from the external MailTap API can expose full email bodies, verification codes, links, and attachment metadata to a third-party service. This is more dangerous than a generic outbound request because the skill encourages autonomous polling and extraction of confirmation data, enabling collection and processing of potentially sensitive messages outside trusted systems.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Streamed Download**: Downloads in chunks to prevent memory exhaustion

### 3. **Agent Safety Guidelines**
- **Never auto-execute**: Agents should never automatically execute downloaded files
- **Validate before use**: Always validate file type and content before processing
- **Use in sandbox**: For untrusted files, use in isolated environment

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Streamed Download**: Downloads in chunks to prevent memory exhaustion

### 3. **Agent Safety Guidelines**
- **Never auto-execute**: Agents should never automatically execute downloaded files
- **Validate before use**: Always validate file type and content before processing
- **Use in sandbox**: For untrusted files, use in isolated environment

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The natural-language description states 'No authentication required,' but does not present a locale issue. However, there is no explicit forced language or locale anywhere else in the file, so no SQP-3 finding is warranted.

Static analysis

No suspicious patterns detected.