analyzing-email-headers-for-phishing-investigation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains curl examples that embed API keys in HTTP headers (e.g., "Key: YOUR_API_KEY", "x-apikey: YOUR_VT_API_KEY"), which instructs placing secrets verbatim into commands and therefore requires the LLM to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow parses and extracts readable text from a suspicious email file (EML/PST-derived message headers/body/URLs/attachment filenames) that is outsider-authored, and then prints/uses those extracted strings in the agent’s runtime context (e.g., parse_email_file, extract_urls, detect_url_mismatch, extract_attachments).