autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/free-tools-abuse/references/session-2026-07-safe-api-probe.md

@@ -0,0 +1,44 @@
+# Session note: safe official API probe harness (2026-07)
+
+## Learning
+A request to "do everything / register / get API keys" in the temp-email/proxy/SMS/VCC space must be reframed to official API validation. Do not register accounts for the user, bypass CAPTCHA, use temp-SMS for third-party verification, generate VCCs, or acquire keys by nonstandard means. Provide a harness that validates legitimate keys supplied via env vars.
+
+## Safe pattern
+- Create `api-provider-probe-safe.py` in the user's workspace.
+- Read all credentials from environment variables only.
+- Redact keys in output by masking fields whose names include: `token`, `secret`, `password`, `api_key`, `apikey`, `access_key`, `authorization`, `auth`, `sid`.
+- Treat expected unauthenticated responses (`401`/`403` or provider-specific `ERROR_WRONG_KEY`) as reachability success when no key is supplied.
+- Mail.tm lifecycle is acceptable for provider connectivity if the mailbox is deleted immediately and bearer/password are not persisted.
+- Write a JSON report next to the script; do not store secrets.
+
+## Providers/env vars covered
+- `WEBSHARE_TOKEN` — `Authorization: Token ...`; check profile and one proxy-list page only.
+- `MAILSAC_KEY` — `Mailsac-Key`; check `/api/me`.
+- `MAILSLURP_API_KEY` — `x-api-key`; check `/inboxes?size=1`.
+- `MAILOSAUR_API_KEY` — HTTP Basic; check `/api/servers`.
+- `SMS_ACTIVATE_KEY` — balance/status only; do not buy numbers.
+- `ONLINESIM_KEY` — balance only; do not rent numbers.
+- `FIVESIM_TOKEN` — profile only; do not buy numbers.
+- `TWILIO_ACCOUNT_SID` + `TWILIO_AUTH_TOKEN` — account resource only.
+
+## Observed quirks from the session
+- On Windows Hermes, `write_file` may reject `/c/Users/User/...` or protected paths; `mcp_filesystem_write_file` with native `C:\Users\User\...` succeeded for allowed directories.
+- `terminal` on this host uses Git Bash/MSYS, so run scripts as `python /c/Users/User/api-provider-probe-safe.py ...`.
+- `mail.tm` returned domains as a JSON list in this run; parsers should also support Hydra-style `hydra:member` responses.
+- `mail.gw` returned `502`; `1secmail` returned `403` from this machine. Do not persist these as universal failures; record them as report results only.
+- `api.sms-activate.org` did not resolve from this host; fallback web domain returned HTML. Prefer official docs/current endpoint before hardcoding conclusions.
+
+## Example command
+```bash
+export WEBSHARE_TOKEN='...'
+export MAILSAC_KEY='...'
+export MAILSLURP_API_KEY='...'
+export MAILOSAUR_API_KEY='...'
+export SMS_ACTIVATE_KEY='...'
+export ONLINESIM_KEY='...'
+export FIVESIM_TOKEN='...'
+export TWILIO_ACCOUNT_SID='...'
+export TWILIO_AUTH_TOKEN='...'
+
+python /c/Users/User/api-provider-probe-safe.py --mailtm-lifecycle --out /c/Users/User/api-provider-probe-safe-report.json
+```