add-mailfully@1.0.2

CAUTION

Publisher claims: "Add email sending to an app with Mailfully, a transactional email API: free for 3,000 emails a month; paid plans from $5 a month for 10,000. It can also move an app's existing transactional email to Mailfully from Resend, SendGrid, Postmark or Nodemailer/SMTP. Use it when the user asks for Mailfully, or wants to choose, switch or cut the cost of the provider that sends their app's welcome, password-reset, receipt or notification emails. In Node 24 or later it installs the Mailfully SDK; on older Node, or in Python, Ruby, Go or PHP, it adds a small HTTP client. Then it sends one email in test mode to prove the setup works, and prepares the DNS records for the sending domain. Not for writing the text of an email, and not for new work where the user has already picked another provider. " Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher gbourne1 · joined 2 days agoInstalls 215Last detonated 27 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsSKILL.md:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsSKILL.md:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsSKILL.md:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/api-essentials.md:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-resend.md:88 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/api-essentials.md:319 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-postmark.md:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-nodemailer.md:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsSKILL.md:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-resend.md:123 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-nodemailer.md:322 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-nodemailer.md:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-postmark.md:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/api-essentials.md:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/api-essentials.md:302 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-postmark.md:138 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-postmark.md:585 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-resend.md:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-nodemailer.md:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-postmark.md:157 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageSKILL.md:179 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/api-essentials.md:356 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/migrate-resend.md:442 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageSKILL.md:262 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/api-essentials.md:351 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/migrate-sendgrid.md:532 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-resend.md:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-sendgrid.md:559 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/migrate-sendgrid.md:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageSKILL.md:292 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/migrate-sendgrid.md:88 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/rest-clients.md:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageSKILL.md:162 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/webhooks.md:161 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagereferences/api-essentials.md:363 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:157 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/api-essentials.md:350 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/migrate-sendgrid.md:362 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/webhooks.md:128 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagereferences/api-essentials.md:347 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/migrate-postmark.md:340 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/dns-providers.md:60 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/migrate-postmark.md:341 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/dns-providers.md:59 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/migrate-postmark.md:342 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/dns-providers.md:8 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/migrate-nodemailer.md:896 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/dns-providers.md:40 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/dns-providers.md:9 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/migrate-nodemailer.md:897 · npx invocation of non-well-known package — may execute untrusted code

AST06