Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add growthenginenowoslawski/coldoutboundskills --skill zapmail-domain-setup-publicgit clone --depth 1 https://github.com/growthenginenowoslawski/coldoutboundskillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/growthenginenowoslawski/coldoutboundskills/zapmail-domain-setup-public)<a href="https://agentmods.dev/skills/growthenginenowoslawski/coldoutboundskills/zapmail-domain-setup-public"><img src="https://agentmods.dev/badge/skills/growthenginenowoslawski/coldoutboundskills/zapmail-domain-setup-public/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/growthenginenowoslawski/coldoutboundskills/zapmail-domain-setup-public"><img src="https://agentmods.dev/badge/skills/growthenginenowoslawski/coldoutboundskills/zapmail-domain-setup-public.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 23 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 30 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Data Exfiltration · line 50 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 151 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 187 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 196 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 225 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 247 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 436 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 437 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 438 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 439 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 56 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 264 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 281 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 299 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 307 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 343 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 365 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 440 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 441 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.04366 |
| Opus 5.5 | $0.00026 | $0.01746 |
| Sonnet 5.5 | $0.00013 | $0.00873 |
| Haiku 4.5 | $0.00006 | $0.00437 |
Grade A, and why
zapmail-domain-setup-public scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**CRITICAL: Comma encoding bug.** When building the URL in Python, default `urllib.parse.urlencode()` encodes commas as `%2C`, which breaks the batch request. Fix: Copies of this mod
1 near-identical copy found in the catalogue:
- zapmail-domain-setup-public — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 461 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cold Email Domain Setup: Dynadot + Zapmail (Public Edition)
Complete workflow to generate short domain names, purchase them on Dynadot, and set them up on Zapmail with inboxes ready for cold email sending.
First-Time Setup (Onboarding)
Before running anything, you need two API keys stored as environment variables.
1. Get Your Dynadot API Key
- Log into dynadot.com
- Go to Tools > API in the left sidebar
- Enable API access and copy your API key
- Whitelist your IP address (required by Dynadot)
2. Get Your Zapmail API Key
- Log into zapmail.ai
- Go to Settings > API
- Copy your API key
3. Store Your Keys
Add these to a .env file in your project root (or export them in your shell):
# .env — NEVER commit this file
DYNADOT_API_KEY=your_dynadot_key_here
ZAPMAIL_API_KEY=your_zapmail_key_here
Load them in your script:
import os
from dotenv import load_dotenv
load_dotenv()
DYNADOT_API_KEY = os.environ["DYNADOT_API_KEY"]
ZAPMAIL_API_KEY = os.environ["ZAPMAIL_API_KEY"]
4. Verify Access
Test both APIs before doing anything:
Dynadot — check wallet balance:
GET https://api.dynadot.com/api3.json?key=<YOUR_KEY>&command=account_info
Response includes AccountBalance (e.g., "$106.20").
Zapmail — list domains:
GET https://api.zapmail.ai/api/v2/domains/assignable?limit=10&page=1
Header: x-auth-zapmail: <YOUR_KEY>
If both return 200, you're ready.
Full Workflow Overview
Step 1: Generate domain name candidates ~instant
Step 2: Check availability on Dynadot ~1 min per 500 domains
Step 3: Purchase available domains ~1 min per 100 domains
| (domains now registered on Dynadot)
Step 4: Switch nameservers to Zapmail ~1 min per 500 domains
| WAIT 15-20 minutes for DNS propagation
Step 5: Connect domains on Zapmail ~2 min per 500 domains
| WAIT 10-30 minutes for domains to become assignable
Step 6: Create inboxes on Zapmail ~3 min per 500 domains
| WAIT 4-6 HOURS for inbox provisioning
Step 7: Export to your email sending platform ~instant
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 461 lines · 65 tokens per session scan A 98f5944f9d13
zapmail-domain-setup-public is a skill published in the GitHub repository growthenginenowoslawski/coldoutboundskills (802 stars, last pushed 1mo ago), licensed MIT. It adds 65 tokens to every session and 4,366 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
zapmail-domain-setup-public compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| zapmail-domain-setup-publicgrowthenginenowoslawski/coldoutboundskills | Skill | 802 | 1mo ago | MIT | A | 65 | Claude Code, Codex |
| imagegenopenai/codex | Skill | 133k | yesterday | Apache-2.0 | A | 113 | Codex |
| playwright-climicrosoft/playwright | Skill | 99k | yesterday | Apache-2.0 | A | 19 | Claude Code |
| local-ai-agentsmicrosoft/ai-agents-for-beginners | Skill | 79k | 4d ago | MIT | A | 200 | Claude Code, Codex |
| systematic-debuggingobra/superpowers | Skill | 313k | 3d ago | MIT | A | 21 | Claude Code |
| next-cache-components-adoptionvercel/next.js | Skill | 143k | today | MIT | A | 95 | Claude Code |
| next-partial-prefetching-adoptionvercel/next.js | Skill | 143k | today | MIT | A | 103 | Claude Code |