Email Importance Content Analysis

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:27 PM UTC
• Version: 1.0.1

Overview

This is a Markdown-only email triage skill with coherent phishing-analysis guidance and no executable code, persistence, or hidden data access.

Install only if you want guidance for manually triaging emails. Treat its result as advisory rather than a complete security filter, especially for non-Chinese subjects or cases where a sender/subject first pass could miss nuance; continue verifying sensitive requests through official channels rather than email links.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: email-importance-content-analysis
description: Judge whether an email is important/urgent using content-based analysis rather than sender name or mailbox labels (which can be spoofed). Use when asked to triage emails, decide priority, detect phishing/social-engineering, or recommend next actions (reply/pay/login/download/click) based on what the message asks the user to do.
---

# Email Importance Content Analysis

Use a **subject/title-first** triage, then perform **technical verification** (headers/links/attachments) only when warranted, and only then validate with **content analysis**. Treat **sender display name, badges, labels, and “From” appearance as untrusted**.

## Workflow (title → technical → content)

### 1) Title/subject + sender triage (cheap first-pass)
Use only: **subject line + sender (display name + email address/

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

Increase risk if the content shows:
- **Urgency / threat**: “within 24h”, “account will be closed”, “legal action”, “final notice”
- **Secrecy / bypass**: “don’t tell others”, “use personal email”, “avoid normal process”
- **Mismatch / vagueness**: generic greeting, unclear context, missing specifics the real sender would know
- **Odd requests**: asking for OTP, gift cards, crypto, remote access, or direct bank changes
- **Link/attachment pressure**: “click to verify”, “download to view”, “enable macros”

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The changelog documents a processing order that relies on subject/sender triage and early drop rules before deeper verification and content analysis, which directly conflicts with the skill's stated content-first, anti-spoofing purpose. In an email triage/phishing-detection skill, this can cause spoofed or socially engineered messages to be incorrectly prioritized, de-prioritized, or discarded based on attacker-controlled metadata, weakening the security guarantees of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The escalation rules are expressed only with Chinese keywords such as 扣款, 登入, and 最後通知, which embeds a language-specific policy into the skill behavior. The file does not state that the skill is intentionally limited to Chinese-language email analysis or offer any user opt-in or multilingual alternative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.