Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-10
Testing for IMAP/SMTP Injection
Passed 14 of 22 test cases with the skill, and 9 of 22 without it.
and 3 more in the full report
5 fixed9 passed either way8 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
When documenting security findings for web application mail injection vulnerabilities, security analysts need consistent CVSS base scores and severity levels. Provide a risk matrix table matching finding types (IMAP command injection, SMTP command injection, Email header injection, and From address spoofing) to their specific CVSS v3 ratings and severity labels.
| Checked | Without skill | With skill |
|---|---|---|
| Assigns CVSS score 6.5 to Email header injection | Missed | Passed |
| Assigns CVSS score 4.3 to From address spoofing | Passed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-10
Testing for IMAP/SMTP Injection
IMAP/SMTP Injection occurs when user input is incorporated into mail server commands without proper validation. Attackers can manipulate email functionality to send spam, access other users' mailboxes, execute arbitrary IMAP/SMTP commands, or bypass email-based security controls.
#!/bin/bash
TARGET="https://target.com/contact"
# Test email header injection via form
echo "[*] Testing email header injection..."
# CC injection
curl -s -X POST "$TARGET" \
test cases passed, vs 9 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.