The Agent Skills Directory

[COMMAND_EXECUTION]: The file scripts/agent.py contains a dns_lookup function that executes the dig command using subprocess.run(shell=True). The function interpolates the domain variable directly into the shell command string without any validation or escaping. This creates a vulnerability to command injection if an attacker crafts an email header with a domain containing shell metacharacters (e.g., 'example.com; rm -rf /').
[EXTERNAL_DOWNLOADS]: The skill documentation suggests installing several external Python packages from public registries to support its forensic capabilities, specifically pypff, pyspf, python-Levenshtein, and dkimpy.

analyzing-email-headers-for-phishing-investigation