skills/aibot88/sec_skill_store/analyzing-email-headers-for-phishing-investigation/Gen Agent Trust Hub
analyzing-email-headers-for-phishing-investigation
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands including dig, whois, and curl to collect forensic data. It also uses Python heredocs to dynamically generate and execute parsing scripts locally.
- [EXTERNAL_DOWNLOADS]: The workflow involves installing third-party Python packages (pypff, pyspf, and python-Levenshtein) via pip to facilitate specialized forensics tasks like PST file handling and domain similarity analysis.
- [DATA_EXFILTRATION]: Extracted IP addresses and domain names are transmitted to external reputation services (AbuseIPDB and VirusTotal). While this is a standard forensic practice, it involves the flow of local metadata to third-party endpoints.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) due to the ingestion of untrusted email data. 1. Ingestion points: Raw email headers and body content are read from .eml and .pst files. 2. Boundary markers: Extracted email data is processed and printed without explicit delimiters or safety instructions. 3. Capability inventory: The agent has access to shell command execution, file system writes, and network requests. 4. Sanitization: No sanitization is performed on the untrusted data extracted from the analyzed emails.
Audit Metadata