{"data":{"skill":{"slug":"caffeinelabs-extension-email-verification","name":"extension-email-verification","icon":"📦","repo":"https://github.com/caffeinelabs/skills/tree/main/skills/extension-email-verification/","status":"approved","author":"caffeinelabs","authorVersion":"0.1.5","skillstoreRevision":2},"audit":{"id":"1f3f8322-c3cf-42a6-93a5-75c806719ccf","skill_id":"1a2ce507-29e5-4e6a-bb82-f0cf206ee200","version":3,"content_hash":"v3:a39a91716eadede5f4cdefd78178fed4e837a128:ece5fe793c36f31dee990f70c4d1f8be731110af705e93e6f9a3a67eb3f88ea3:6befa64f87ab352a744750d3f1a832c688ef62ad78dc258d3ac2f4269437caea:736b696c6c732f6361666665696e656c6162732f657874656e73696f6e2d656d61696c2d766572696669636174696f6e:3184a5b9e329056414fcd325f3218d58","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 13 static findings are false positives caused by Markdown code spans, code fences, an informational URL, and a relative documentation link. The embedded example still presents two medium risks: unescaped user input in HTML email and a publicly callable email-sending flow without explicit abuse controls. These example patterns should be hardened before publication.","remediation":[{"issue":"The example concatenates the user-provided name directly into an HTML email body.","severity":"medium","suggestion":"Escape or sanitize all user-controlled values before inserting them into HTML email content."},{"issue":"The public registration example sends email without documented rate limits or cooldowns.","severity":"medium","suggestion":"Require an appropriate identity, validate addresses, and add per-caller and per-address rate limits before sending email."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":45,"line_start":27},{"file":"SKILL.md","line_end":47,"line_start":45},{"file":"SKILL.md","line_end":51,"line_start":47},{"file":"SKILL.md","line_end":55,"line_start":51},{"file":"SKILL.md","line_end":57,"line_start":55},{"file":"SKILL.md","line_end":67,"line_start":57},{"file":"SKILL.md","line_end":81,"line_start":67},{"file":"SKILL.md","line_end":85,"line_start":81},{"file":"SKILL.md","line_end":152,"line_start":85}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":13,"line_start":13}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":61,"line_start":61}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"User Input Inserted Into HTML Email","locations":[{"file":"SKILL.md","line_end":130,"line_start":112}],"confidence":0.97,"description":"The registration example concatenates the caller-provided name into htmlBody without escaping. A crafted name could inject misleading HTML into the verification email.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The name parameter is accepted on line 112 and directly concatenated into HTML on line 130. No escaping or sanitization appears in the example."},{"title":"Verification Email Abuse Controls Are Missing","locations":[{"file":"SKILL.md","line_end":131,"line_start":112}],"confidence":0.9,"description":"The public registration example sends a verification message to a caller-supplied address without documented throttling. Attackers could use many identities to send unwanted email.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The public function accepts an email and immediately calls sendVerificationEmail. The shown flow has no rate limit, cooldown, or broader abuse control."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":157,"audit_model":"codex","audited_at":"2026-07-23T12:02:24.368+00:00","created_at":"2026-07-24T13:22:58.342939+00:00","static_findings":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"This skill adds email address verification via a click-to-verify link. The `MixinEmailVerification` ","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use the prefabricated module `mo:caffeineai-email-verification/verifiedEmails.mo` which cannot be mo","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```mo:caffeineai-email-verification/verifiedEmails.mo","category":"external_commands","line_end":45,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":47,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"To check whether an email is verified use the `contains` function. Do NOT try to track the email ver","category":"external_commands","line_end":51,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use the prefabricated module `mo:caffeineai-email-verification/verificationMixin.mo` which cannot be","category":"external_commands","line_end":55,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```mo:caffeineai-email-verification/verificationMixin.mo","category":"external_commands","line_end":57,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":67,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```mo:caffeineai-email/emailClient.mo","category":"external_commands","line_end":81,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":85,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```motoko filepath=src/backend/main.mo","category":"external_commands","line_end":152,"severity":"medium","line_start":85},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Email verification extension for [Caffeine AI](https://caffeine.ai?utm_source=caffeine-skill&utm_med","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"filesystem:SKILL.md:61:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- This extension depends on the [extension-email](../extension-email/SKILL.md) for sending emails.","category":"filesystem","line_end":61,"severity":"high","line_start":61}],"finding_verdicts":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Line 17 uses Markdown backticks around Motoko module names. It does not invoke a shell or execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"Line 25 uses a Markdown code span to name a prefabricated Motoko module. No shell syntax or command execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 starts a fenced Motoko interface example. The backticks are Markdown delimiters and cannot execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Line 45 closes a Markdown code fence. It contains no executable shell expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"Line 47 formats the Motoko function name contains with Markdown backticks. This is documentation, not external command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Line 51 uses a Markdown code span for a Motoko module path. It does not pass data to a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"Line 55 opens a fenced Motoko import example. The detected backticks only control Markdown formatting.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"Line 57 closes a Markdown code fence. There is no command interpreter or execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"Line 67 opens a fenced Motoko API signature. The backticks are documentation syntax and do not run a process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"Line 81 closes a Markdown code fence. It has no external command behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"Line 85 opens an embedded Motoko example and declares its illustrative file path. The Markdown fence does not execute shell commands.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"Line 13 contains a visible documentation link to the Caffeine AI website. It does not perform a request or transmit user data.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:61:path-traversal-sequence","reason":"Line 61 is a relative Markdown link to a sibling skill document. No filesystem API resolves user-controlled input or reads arbitrary paths.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"User Input Inserted Into HTML Email","severity":"medium","locations":[{"file":"SKILL.md","line_end":130,"line_start":112}],"confidence":0.97,"description":"The registration example concatenates the caller-provided name into htmlBody without escaping. A crafted name could inject misleading HTML into the verification email.","confidence_reasoning":"The name parameter is accepted on line 112 and directly concatenated into HTML on line 130. No escaping or sanitization appears in the example."},{"title":"Verification Email Abuse Controls Are Missing","severity":"medium","locations":[{"file":"SKILL.md","line_end":131,"line_start":112}],"confidence":0.9,"description":"The public registration example sends a verification message to a caller-supplied address without documented throttling. Attackers could use many identities to send unwanted email.","confidence_reasoning":"The public function accepts an email and immediately calls sendVerificationEmail. The shown flow has no rate limit, cooldown, or broader abuse control."}],"subject_marketplace_commit_sha":"a39a91716eadede5f4cdefd78178fed4e837a128","subject_content_hash":"ece5fe793c36f31dee990f70c4d1f8be731110af705e93e6f9a3a67eb3f88ea3","subject_tree_hash":"6befa64f87ab352a744750d3f1a832c688ef62ad78dc258d3ac2f4269437caea","subject_plugin_path":"skills/caffeinelabs/extension-email-verification","audit_payload_hash":"3184a5b9e329056414fcd325f3218d58","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"a39a91716eadede5f4cdefd78178fed4e837a128","contentHash":"ece5fe793c36f31dee990f70c4d1f8be731110af705e93e6f9a3a67eb3f88ea3","treeHash":"6befa64f87ab352a744750d3f1a832c688ef62ad78dc258d3ac2f4269437caea","pluginPath":"skills/caffeinelabs/extension-email-verification","auditPayloadHash":"3184a5b9e329056414fcd325f3218d58"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/caffeinelabs-extension-email-verification/audits/3/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}