中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:1 day ago Rescan
15 /100
moltbotden-email
Free email for AI agents. Get {your-id}@agents.moltbotden.com. Send and receive email via REST API.
A documentation-only SKILL.md for a third-party agent email service with no executable code, no sensitive file access, and well-defined network behavior through declared REST API endpoints.
Skill Namemoltbotden-email
Duration32.5s
Enginepi
✓
Safe to install
Approve for use. If deploying, ensure the external moltbotden.com API domain is a trusted endpoint and consider pinning the API base URL version.

Findings 2 items

Severity Finding Location
Low
Network WRITE permission not declared in allowed-tools Doc Mismatch
The skill describes sending emails (POST requests) and registering agents, which implies network:WRITE. This is not declared in the SKILL.md allowed-tools mapping, creating a minor doc-to-behavior mismatch.
curl -X POST https://api.moltbotden.com/agents/register
→ Add 'network:WRITE' to the allowed-tools section if the skill will be implemented with tool-based execution.
 SKILL.md:20
Low
Third-party API dependency on moltbotden.com Supply Chain
All email operations depend on the external moltbotden.com API. The domain is not verified, and there is no version pinning or fallback. API availability and privacy policy of moltbotden.com are external trust dependencies.
api_base: https://api.moltbotden.com
→ Verify moltbotden.com is a trusted provider. Document the API terms of service and data handling practices before production use.
 SKILL.md:6
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No filesystem access in SKILL.md
Network NONE WRITE ✓ Aligned SKILL.md lines 20-53: POST to /agents/register, /email/send, GET /email/inbox, /…
Shell NONE NONE — No shell commands in SKILL.md
Environment NONE NONE — No environment variable access in SKILL.md
Skill Invoke NONE NONE — No nested skill invocation
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser automation
Database NONE NONE — No database access
9 findings
🔗
Medium External URL 外部 URL
https://moltbotden.com/docs/email
SKILL.md:5
🔗
Medium External URL 外部 URL
https://api.moltbotden.com
SKILL.md:6
🔗
Medium External URL 外部 URL
https://api.moltbotden.com/agents/register
SKILL.md:20
🔗
Medium External URL 外部 URL
https://api.moltbotden.com/email/inbox?unread_only=true&limit=10
SKILL.md:29
🔗
Medium External URL 外部 URL
https://api.moltbotden.com/email/send
SKILL.md:35
🔗
Medium External URL 外部 URL
https://api.moltbotden.com/email/thread/
SKILL.md:47
🔗
Medium External URL 外部 URL
https://api.moltbotden.com/email/account
SKILL.md:53
📧
Info Email 邮箱地址
[email protected]
SKILL.md:25
📧
Info Email 邮箱地址
[email protected]
SKILL.md:39

File Tree

1 files · 1.8 KB · 65 lines
Markdown 1f · 65L
└─ 📝 SKILL.md Markdown 65L · 1.8 KB

Security Positives

✓ No executable code present — this is a documentation-only SKILL.md
✓ No credential harvesting, key enumeration, or environment variable access
✓ No filesystem, shell, or sensitive path access
✓ No obfuscation, base64 encoding, or anti-analysis patterns
✓ No hidden functionality or shadow features
✓ No supply-chain risks from dependencies (no package files)
✓ API endpoints are clearly declared with authentication requirements
✓ No C2 communication, reverse shell, or data exfiltration patterns