mail-code SKILL.md skillA
mail-code from hellodqy/mastermind-bug-bounty is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add hellodqy/mastermind-bug-bounty/mail-code@git:20260915.240c761Pins git:20260915.240c761 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- hellodqy/mastermind-bug-bounty
- Path
skills/mail_code/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260915.240c761, committed Sep 15, 2026
- Size
- 2,432 bytes
- Repository stars
- 14
- License
- none declared
Create and monitor a disposable test mailbox when an authorized registration, recovery, email-verification, or magic-link flow requires an isolated email identity.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Mail Code ## Goal 用独立临时邮箱打通授权测试中的注册、激活、找回、登录发码和换绑流程，并把收到的验证码或验证链接交还认证测试链路。 ## Tools / Inputs - 脚本（相对项目根目录）：`skills/mail_code/scripts/mail_code.py` - Python 3 标准库、可访问 `https://api.mail.tm` 的网络、目标站测试账号 ## Constraints 1. 仅用于自有测试账号和已授权目标，不用于批量养号或真实用户账号。 2. 临时邮箱服务可看到邮件内容，不接收生产秘密、个人数据或高价值账号重置邮件。 3. 凭据优先写入权限为 `0600` 的 account file，不在对话、报告或工作日志展示 token/password。 4. 使用 sender、subject 和触发时间筛选邮件，不能把任意数字直接视为目标验证码。 5. 接码只是流程辅助；只有后续认证、授权或业务边界被突破才进入 verifier。 ## Workflow 从项目根目录运行： ```bash # 创建邮箱并将凭据安全写入 runtime 文件 python3 skills/mail_code/scripts/mail_code.py create \ --account-file runtime/mail-account.json # 在目标站触发邮件后，按发件人/主题轮询验证码或验证链接 python3 skills/mail_code/scripts/mail_code.py poll \ --account-file runtime/mail-account.json \ --sender example.com --subject verify --extract both --timeout 300 # 查看匹配邮件摘要 python3 skills/mail_code/scripts/mail_code.py list \ --account-file runtime/mail-account.json # 使用完成后删除临时邮箱账号 python3 skills/mail_code/scripts/mail_code.py delete \ --account-file runtime/mail-account.json ``` 若 account file 不可用，脚本仍支持 `--address` 与 `--password`，但命令行参数可能进入 shell 历史，应避免在持久环境使用。 ## Chain Questions - 邮件挑战绑定的是哪个账号、会话、动作和有效期？ - 验证码或链接能否重放、跨账号、跨用途或跨流程使用？ …
Read the whole file at its exact version.
How to install
mdr add hellodqy/mastermind-bug-bounty/mail-code@sha256:32cf7e8c679e0db7The line at the top of this page pins the label git:20260915.240c761, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_hbw2iu5bljchbnrx)
5 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 15, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (2432 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
hellodqy/mastermind-bug-bounty · 14 stars · license none declared · pushed 2026-09-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_hbw2iu5bljchbnrx GET https://markdownregistry.com/api/v1/resolve?ref=hellodqy/mastermind-bug-bounty/mail-code GET https://markdownregistry.com/api/v1/blob/32cf7e8c679e0db71d24d5eac1f651958f932e2b20502506a5be1b661016767e
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.