analyzing-email-headers-for-phishing-investigation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples that embed API keys directly into curl commands/headers (e.g., "Key: YOUR_API_KEY", "x-apikey: YOUR_VT_API_KEY"), which encourages the agent to insert secret values verbatim into generated commands or code, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The workflow ingests the raw phishing email headers from a user-provided EML/PST evidence path (e.g., /cases/case-2024-001/email/phishing_email.eml), which is outsider-authored free text (the email content written by an external sender) that is parsed into LLM-readable strings via email.message_from_file(...) and printed/processed.