testing-for-email-header-injection

SUSPICIOUS/HIGH-RISK skill. Its capabilities align with its stated penetration-testing purpose, but that purpose is inherently offensive: it equips an AI agent to probe and potentially abuse email functionality for spoofing, spam relay, recipient injection, and password-reset interception. There is no evidence of hidden malware, covert exfiltration to unrelated domains, or deceptive installers, but as an AI-agent skill it meaningfully increases real-world attack capability and should be treated as high security risk.

This module is an offensively oriented exploit/testing agent that crafts CRLF and email header injection payloads (including encoded bypass variants) and sends them via HTTP POST to an arbitrary operator-supplied endpoint. It records “successful” injection heuristics and writes a local report, with no obvious stealth/persistence/data-theft behaviors in this fragment. The primary risk is misuse: if included in a supply chain, it meaningfully increases the potential for unauthorized probing/exploitation of email-handling vulnerabilities.