Email Header Analyser

Analyzes email headers to extract authentication, routing, and security metadata for threat detection and email forensics.

Security Scan

The skill claims to be an email-header analysis API but omits key implementation details (server, auth) and advertises external endpoints—so using it could send sensitive headers to an unknown third party without clear authorization or privacy guarantees.

Purpose & Capability

The SKILL.md and openapi describe an API-based email header analyzer and list external hostnames (api.mkkpro.com, toolweb.in). However the skill declares no servers in the OpenAPI, no install, and no required credentials. If this skill is expected to call a third‑party API, it should declare the server URL and any required API keys. The absence of those items is inconsistent with a hosted API integration.

Instruction Scope

The instructions describe accepting raw email headers and returning parsed forensic results. They do not instruct reading local files or env vars, which is good, but they implicitly direct the agent to use an external service (links and a Kong route are provided). That means sensitive email headers (containing IPs, addresses, possibly internal routing info) would be transmitted to the listed third parties. There is no privacy notice, no explicit consent step, and no guidance to avoid sending production-sensitive headers.

Install Mechanism

This is an instruction-only skill with no install spec or code — lowest disk/write risk. However, because it appears to rely on an external API, the security surface is runtime network calls rather than local installation. That makes network destination and authentication the primary risk vectors.

Credentials

The skill lists pricing plans (Free/Developer/Professional/Enterprise) which implies an API that likely requires keys or an account, yet requires.env and primary credential are empty. This omission is disproportionate: a hosted API integration should declare required credentials or clearly document how authentication is handled. The mismatch makes it unclear whether the skill will prompt users for credentials or silently transmit data.

Persistence & Privilege

always is false and there are no declared actions that modify other skills or system settings. The skill can be invoked autonomously by the agent (platform default), which increases risk only in combination with the other concerns above, but autonomy alone is not flagged.

What to consider before installing

This skill appears to be a thin API descriptor that points at third-party hosts (api.mkkpro.com, toolweb.in) but does not declare the server URL in OpenAPI or any required API keys. Before installing or using it: (1) confirm who operates the api.mkkpro.com/toolweb.in endpoints and read their privacy/security policy; (2) assume any header text you submit will be transmitted off‑host — email headers can contain PII and internal network information, so do not submit production or sensitive headers until you trust the endpoint; (3) ask the skill author to include the API server(s) in openapi.json, declare required credentials, and document how data is handled, retained, and protected; (4) if you need offline/local analysis, prefer a skill or tool that runs parsing code locally or provide your own self‑hosted endpoint; (5) test with synthetic headers first. If the author cannot provide clear hosting/authentication/privacy details, treat the skill as unsafe for sensitive data.

Overview

The Email Header Analyser API provides deep inspection and forensic analysis of email message headers. Security professionals, incident responders, and email administrators use this tool to identify spoofing attempts, trace message routing, validate authentication protocols (SPF, DKIM, DMARC), and detect malicious headers.

Email headers contain critical metadata that reveals the true origin of messages, intermediate mail servers, and authentication status. This API parses raw headers and extracts actionable intelligence for phishing investigations, compliance audits, and email security operations.

Ideal users include SOC analysts, email security teams, incident response professionals, forensic investigators, and organizations requiring email authentication verification and threat intelligence capabilities.

Usage

Sample Request

{
  "header": "Received: from mail.example.com (mail.example.com [192.0.2.1]) by mx.targetdomain.com with SMTP id abc123; Wed, 15 Jan 2025 10:30:45 +0000\nFrom: [e-mail]\nTo: [e-mail]\nSubject: Security Analysis\nAuthentication-Results: targetdomain.com; spf=pass smtp.mailfrom=[e-mail]; dkim=pass header.d=example.com; dmarc=pass\nReturn-Path: <[e-mail]>\nDate: Wed, 15 Jan 2025 10:30:45 +0000"
}

Sample Response

{
  "sender_ip": "192.0.2.1",
  "sender_domain": "mail.example.com",
  "from_address": "[e-mail]",
  "to_address": "[e-mail]",
  "received_servers": [
    {
      "hostname": "mail.example.com",
      "ip": "192.0.2.1",
      "timestamp": "2025-01-15T10:30:45Z"
    },
    {
      "hostname": "mx.targetdomain.com",
      "ip": null,
      "timestamp": null
    }
  ],
  "authentication": {
    "spf": "pass",
    "dkim": "pass",
    "dmarc": "pass"
  },
  "subject": "Security Analysis",
  "date": "2025-01-15T10:30:45Z",
  "return_path": "[e-mail]",
  "suspicious_indicators": []
}

Endpoints

POST /analyze-header

Analyzes a raw email header to extract authentication, routing, and security metadata.

Method: POST
Path: /analyze-header

Request Parameters:

Parameter	Type	Required	Description
header	string	Yes	Raw email header text containing one or more Received headers, authentication headers, and message metadata.

Response Schema:

The response contains extracted header analysis including:

Field	Type	Description
sender_ip	string	IP address of the originating mail server.
sender_domain	string	Hostname of the originating mail server.
from_address	string	Email address in the From header.
to_address	string	Email address in the To header.
received_servers	array	List of mail servers in the routing path with hostname, IP, and timestamp.
authentication	object	Authentication protocol results (spf, dkim, dmarc status).
subject	string	Email subject line.
date	string	Message date in ISO 8601 format.
return_path	string	Return-Path header value.
suspicious_indicators	array	List of detected anomalies or security concerns.

Status Codes:

• 200: Successful analysis returned.
• 422: Validation error—header field missing or invalid.

Pricing

Plan	Calls/Day	Calls/Month	Price
Free	5	50	Free
Developer	20	500	$39/mo
Professional	200	5,000	$99/mo
Enterprise	100,000	1,000,000	$299/mo

About

ToolWeb.in - 200+ security APIs, CISSP & CISM, platforms: Pay-per-run, API Gateway, MCP Server, OpenClaw, RapidAPI, YouTube.

• toolweb.in
• portal.toolweb.in
• hub.toolweb.in
• toolweb.in/openclaw/
• rapidapi.com/user/mkrishna477
• youtube.com/@toolweb-009

References

• Kong Route: https://api.mkkpro.com/security/email-header-analyser
• API Docs: https://api.mkkpro.com:8016/docs