investigating-phishing-email-incident

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's example code embeds API keys and an access token directly into request headers and client constructors (e.g., "API-Key": "YOUR_KEY", vt.Client("YOUR_VT_API_KEY"), and f"Bearer {access_token}"), which requires supplying secret values verbatim and therefore poses an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow parses and extracts readable email content from a user-provided .eml phishing sample (outsider-authored email body/headers) and then feeds derived free text (e.g., From, Subject, Received chain, and extracted URLs) into the agent’s generated report/output context.