phishing-email-html

This skill is malicious in purpose: it equips an AI agent to produce realistic, platform-ready phishing emails and tracking-enabled templates for phishing campaigns. There is little install-chain risk in the file itself, but the capability is inherently incompatible with benign productivity use and directly supports credential theft and deceptive social engineering.

This is not executable malware code; it is a workflow configuration that explicitly enables generation/rendering of phishing-pretext content as email HTML using an external input ($phishing-email-html). While there are no technical malicious behaviors visible in the fragment (no obfuscation, network, or process actions), the explicit phishing intent and lack of shown content-safety controls make it a notable security concern in supply-chain and misuse contexts. A complete assessment would require the unseen implementation that consumes $phishing-email-html, performs rendering/sanitization, and handles downstream sending/logging.