Skills extension-email-verification
📦

extension-email-verification

v0.1.5 Content revision r2 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Add Email Verification to Caffeine AI Apps

Unverified addresses can weaken account trust and communication. This skill guides Caffeine AI developers through click-to-verify flows using supported Motoko modules.

Supports: Claude Codex Code(CC)
📊 71 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "extension-email-verification" from https://skillstore.io/skills/caffeinelabs-extension-email-verification.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-extension-email-verification/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/caffeinelabs-extension-email-verification.md Signed manifest GET /api/skills/caffeinelabs-extension-email-verification/manifest Signed lockfile GET /api/skills/caffeinelabs-extension-email-verification/lockfile

Test it

Using "extension-email-verification". Add verification to a new Motoko actor.

Expected outcome:

A backend plan covering package imports, verified-address state, callback mixin inclusion, email sending, and a verified-status query.

Using "extension-email-verification". Create a safe registration email flow.

Expected outcome:

  • Validate and normalize the submitted address.
  • Escape the display name before building HTML.
  • Send one message containing the required verification URL placeholder.
  • Handle delivery errors and apply request limits.

Using "extension-email-verification". Explain how verified status should be stored.

Expected outcome:

Use the prefabricated verified email state and its contains function. Do not duplicate verification status in user profiles.

Security Audit

Medium Risk
v3 • 7/23/2026 Open versioned report

All 13 static findings are false positives caused by Markdown code spans, code fences, an informational URL, and a relative documentation link. The embedded example still presents two medium risks: unescaped user input in HTML email and a publicly callable email-sending flow without explicit abuse controls. These example patterns should be hardened before publication.

1
Files scanned
157
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
SKILL.md:112-130
User Input Inserted Into HTML Email
The registration example concatenates the caller-provided name into htmlBody without escaping. A crafted name could inject misleading HTML into the verification email.
The name parameter is accepted on line 112 and directly concatenated into HTML on line 130. No escaping or sanitization appears in the example.
Medium
SKILL.md:112-131
Verification Email Abuse Controls Are Missing
The public registration example sends a verification message to a caller-supplied address without documented throttling. Attackers could use many identities to send unwanted email.
The public function accepts an email and immediately calls sendVerificationEmail. The shown flow has no rate limit, cooldown, or broader abuse control.

Risk Factors

⚙️ External commands (11)
SKILL.md:17 SKILL.md:25 SKILL.md:27-45 SKILL.md:45-47 SKILL.md:47-51 SKILL.md:51-55 SKILL.md:55-57 SKILL.md:57-67 SKILL.md:67-81 SKILL.md:81-85 SKILL.md:85-152
🌐 Network access (1)
SKILL.md:13
📁 Filesystem access (1)
SKILL.md:61
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/caffeinelabs-extension-email-verification/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-extension-email-verification/security.svg)](https://skillstore.io/skills/caffeinelabs-extension-email-verification?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/caffeinelabs-extension-email-verification?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-extension-email-verification/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-extension-email-verification.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

caffeinelabs. (2026). extension-email-verification security audit report (audit version 3) [Author version 0.1.5]. Skillstore. https://skillstore.io/skills/caffeinelabs-extension-email-verification/audits/3

BibTeX citation

@techreport{caffeinelabs-caffeinelabs-extension-email-verification-2026, author = {caffeinelabs}, title = {extension-email-verification security audit report (audit version 3)}, institution = {Skillstore}, year = {2026}, number = {3}, url = {https://skillstore.io/skills/caffeinelabs-extension-email-verification/audits/3}, note = {Author version 0.1.5} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "extension-email-verification security audit report (audit version 3)" version: "0.1.5" type: report authors: - name: "caffeinelabs" date-released: "2026-07-23" url: "https://skillstore.io/skills/caffeinelabs-extension-email-verification/audits/3" identifiers: - type: other value: "skillstore:caffeinelabs-extension-email-verification:audit:3" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
100
Maintainability
87
Content
67
Community
91
Spec Compliance

What You Can Build

Verify New Accounts

Add ownership confirmation to a Motoko registration flow before enabling trusted account actions.

Track Verified Addresses

Use the supported state module to check verified status without duplicating profile fields.

Prepare Verification Templates

Build admin-managed email content that keeps the required verification URL placeholder.

Try These Prompts

Set Up Verification 
Add email verification to my Caffeine AI Motoko app. Show the required imports, state initialization, and callback mixin.
Send a Verification Message 
Create a verification email flow for new users. Include the required URL placeholder and handle the send result.
Build Registration Checks 
Design registration and verified-status endpoints. Prevent duplicate callers and duplicate addresses while using the supported verified email store.
Harden the Verification Flow 
Review my verification design for abuse risks. Add input validation, HTML escaping, rate limits, and tests while preserving the supported modules.

Best Practices

  • Use the supported verified email store as the single source of verification status.
  • Keep the verification URL placeholder in every HTML template sent through the extension.
  • Validate addresses, escape HTML values, and rate-limit verification requests.

Avoid

  • Do not store a separate verification flag on each user profile.
  • Do not remove or alter the required verification URL placeholder.
  • Do not place unescaped user input directly into an HTML email.

Frequently Asked Questions

What does this skill verify?
It supports proof that a recipient controls an email address by using a recipient-specific verification link.
Which platform does it target?
It targets Caffeine AI applications written in Motoko.
Which dependency sends the email?
The separate Caffeine AI email extension provides the sendVerificationEmail function.
Where is verified status stored?
The prefabricated verifiedEmails module stores verified addresses and provides the contains function.
What must every email template include?
The HTML body must include the VERIFICATION_URL placeholder for the recipient-specific link.
Is the sample ready for production?
No. Add input validation, HTML escaping, rate limits, monitoring, and tests before production use.

Developer Details

License

MIT

Author version

v0.1.5

Skillstore revision

r2

Repository

https://github.com/caffeinelabs/skills/tree/main/skills/extension-email-verification/

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

1 downloads · 1 views

File structure

📄 SKILL.md