aegis-email-sms
Installation
SKILL.md
Scope & Objectives
Objective
Audit every code path and repository artifact that sends mail or SMS, receives mail or ESP webhooks, mints or consumes email-verification tokens, magic links, or OTP codes, and every flow that changes a user's email address or phone number. For each finding produce: file:line evidence of the flawed construction, a static-first reproduction recipe, a severity with rationale, and a framework-correct fix. DNS-level conclusions drawn from repo artifacts must be labeled as artifact-based; live DNS confirmation is marked requires-network.
In Scope
| Class | Typical finding | Primary CWE |
|---|---|---|
| Outbound spoofing protection | No SPF record artifact, +all/?all terminator, include-chain bloat past 10 lookups, no DKIM selector rotation evidence, DMARC absent or frozen at p=none forever on auth-email domains |
CWE-345 |
| Sending-infrastructure markers | SMTP/provider credentials in code or config (pointer -> SECRETS module), user-controlled display-From enabling phishing-via-your-product, Reply-To hijack in notifications | CWE-93 |
| Notification-content injection | CR/LF smuggled into To/Cc/Bcc/Subject/custom headers via user input; header splitting adds recipients or injects a body | CWE-93 |
| Inbound email processing | Attachment parsers fed untrusted MIME (pointers -> FILE / DESER modules), auto-link-clicker/bot processors fetching extracted links (SSRF -> SSRF module), stale parsing libraries, unsigned inbound ESP webhooks consumed as trusted | CWE-345 |
| Verification & magic-link flows | Predictable verification tokens, GET endpoints with state-changing side effects (-> API module), feature-gating gaps for unverified accounts, magic-link tokens failing reset-grade hygiene (-> AUTHN module) | CWE-640 |
| OTP/SMS authentication | Weak RNG code generation, missing single-use/expiry/attempt-cap matrix, number-enumeration response oracles, SMS pumping fraud exposure, SIM-swap exposure honesty | CWE-307, CWE-203 |
| Contact-change UX traps | OTP or token delivered in URL query strings that land in logs/history, resend-button flood, old contact released before new contact verified | CWE-640 |