What problem does it solve? During authorized security testing, a target site often requires email registration but no test account credentials are provided. This Skill creates a temporary mailbox, receives verification codes automatically, and establishes an authenticated session so post-login attack surfaces (IDOR, privilege escalation, business logic flaws) become testable. ## Core Features & Use Cases - Temporary Mailbox Creation: Calls the mail.tm public REST API (no API key required) to create a random-address mailbox and returns address, password, and token as JSON. - Verification Code Polling: Polls the inbox with exponential backoff, extracting 4-8 digit codes from emails, with configurable timeout for delayed delivery. - Credential Persistence: Writes registered account credentials to an evidence file so subsequent testing phases automatically recognize an authenticated state. - Use Case: While testing an authorized target whose JS reveals a register-plus-email-verification flow, create a mailbox, register on the target, poll for the code, complete verification, and then test authenticated endpoints for IDOR and account-takeover flaws such as registration endpoints that ignore password validation. ## Quick Start Ask the agent to use the mail_code tool to create a temporary mailbox, register an account on the target's email signup flow, and poll for the verification code to obtain an authenticated session.
