skills/temporary-email/SKILL.md
Create and read disposable Mail.tm inboxes for owned test account setup.
npx skillsauth add ghostonbutterbread/bug-bounty-harness temporary-emailInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Use when Codex or Claude needs a disposable inbox for an owned target account.
This skill only manages temporary inboxes and verification mail. It does not manage Ghost's Gmail and it does not create durable researcher accounts.
Temporary inboxes and target accounts must carry an explicit destructible status. Default is destructible: no.
Create a mailbox:
agent-email create
Read latest messages:
agent-email read <email|alias> --limit 10
agent-email read <email|alias> --wait 60 --interval 3
Show one message:
agent-email show <email|alias> <messageId>
List known temporary inboxes:
agent-email accounts list
agent-email config path
destructible: yes only when the inbox/account is explicitly intended for mutation, deletion, burn, or destructive-flow testing.destructible: no unless the stored email metadata clearly marks them destructible. A plus-addressed test identity such as [email protected] may be marked destructible when that is its recorded purpose.When creating or recording an inbox/account, include:
Account alias:
Email reference:
Target/program:
Purpose:
Destructible: yes|no
Destructible reason:
Credential store item:
Cleanup notes:
If destructible status is missing, treat the account as destructible: no.
Stop and ask Ryushe if the target blocks the generated temporary email domain, requires phone/KYC, payment, SSO, a pre-approved account, explicitly bans disposable email, or the requested test needs a destructible account but none is marked destructible: yes.
documentation
Use when attacker-controlled input is saved and rendered later in a profile, comment, title, notification, admin view, export, email, feed, upload metadata, or other stored render surface.
content-media
Use when attacker-controlled input appears in the immediate HTTP response or browser-rendered page and needs reflected XSS context classification, payload selection, mutation, and browser verification.
data-ai
Use when inspecting proxy traffic from PwnFox-profiled browser sessions, filtering Caido/Burp/proxy history by X-PwnFox-Color, or interpreting user phrases like 'Red session' as a distinct browser/auth/profile lane.
tools
# LFI — Local File Inclusion Bypass ## What It Does Tests LFI bypass techniques: path traversal, null bytes, wrappers, log poisoning. Load `general-security-testing-policy`, `live-testing-policy`, and `injection-testing-policy` before live testing. For file/path sinks, absence of an immediate file read or response delta is not a stop reason by itself; use the policy to reason about path normalization, extension allowlists, wrappers, encoding, parser differences, and stack-specific proof ladder