skills/mukul975/anthropic-cybersecurity-skills/building-phishing-reporting-button-workflow/Gen Agent Trust Hub
building-phishing-reporting-button-workflow
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements logic for parsing and analyzing reported phishing emails. It uses standard Python libraries and communicates with well-known security services (VirusTotal). No credential theft, persistence, or malicious code execution was found.
- [PROMPT_INJECTION]: The skill processes external, untrusted content from reported email files, which presents a surface for indirect prompt injection.
- Ingestion points: The
scripts/agent.pyandscripts/process.pyscripts read untrusted.emlfiles provided as input. - Boundary markers: The skill does not use specific delimiters or instructions to prevent the agent from following instructions embedded in the processed emails.
- Capability inventory: The skill uses the
requestslibrary for external API communication and performs file write operations for reporting. - Sanitization: The scripts truncate email bodies to 5000 characters and use regular expressions for extraction, but do not sanitize the content to prevent the interpretation of malicious instructions by an AI agent.
Audit Metadata