Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sendx/email-skills --skill esp-malicious-behavior-skillgit clone --depth 1 https://github.com/sendx/email-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sendx/email-skills/esp-malicious-behavior-skill)<a href="https://agentmods.dev/skills/sendx/email-skills/esp-malicious-behavior-skill"><img src="https://agentmods.dev/badge/skills/sendx/email-skills/esp-malicious-behavior-skill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.00889 |
| Opus 5 | $0.00025 | $0.00445 |
| Sonnet 5 | $0.00010 | $0.00178 |
| Haiku 4.5 | $0.00005 | $0.00089 |
Grade A, and why
malicious-behavior scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Malicious Sending Behavior Detection
Platform Configuration — Fill These In to Match Your ESP
This skill uses example thresholds by default. Fill in your platform's actual policies below so the investigation triggers and risk signals match how your ESP works.
- Max contacts for new accounts (before review): [e.g., 10,000]
- Bounce rate lock threshold: [e.g., 5% hard bounce rate]
- Suspicious upgrade window: [e.g., high-tier upgrade within 7 days of signup]
- Support/ticketing system: [e.g., Zendesk, Freshdesk, custom]
What You Are Looking For
The Classic Spammer Arrives with a pre-built list. Wants to blast as many emails as possible before getting caught. Signals: Math does not work. Instant scaling. Evasive about list source. No real opt-in flow. Aggressive and threatening. Sketchy content (crypto, get-rich-quick, vague proposals).
The Purchased List Operator Bought or rented a list. Claims it is organic. Signals: High bounce rate from first campaign. List size inconsistent with business and domain age. No working signup form. Contacts spread across unrelated domains.
The Scraper Built a list by harvesting addresses without consent. Signals: Large list on new account. Mixed industries or geographies inconsistent with the business. Cannot explain consent mechanism.
The Bad Actor Using Legitimate Cover A real business that has crossed the line. Signals: Sudden bounce spike after period of normal sending. New campaign content inconsistent with prior campaigns. Recent import from unknown source.
Investigation Process
Step 1: Pull Account Data from Your Internal Database
- Account creation date and tier upgrade timeline
- Total contacts over time (growth curve)
- Send volume per campaign and bounce rate trends
- Previous lock events
Step 2: Domain Research
- WHOIS lookup for domain age
- Is the website live and legitimate?
- Does traffic plausibly support claimed signup volume?
Step 3: Content Review
- Does content match stated business purpose?
- Red flags: crypto, loans, vague offers, affiliate schemes
- Is there a privacy policy and unsubscribe mechanism?
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 121 lines · 50 tokens per session scan A f5b8b69a7424
malicious-behavior is a skill published in the GitHub repository sendx/email-skills (8 stars, last pushed 1mo ago), licensed MIT. It adds 50 tokens to every session and 889 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
email-marketing-bible
Data-backed email marketing skill for AI agents. Use when building or running email automation, driving an ESP from an agent (MCP/connectors), diagnosing deliverability, writing or de-slopping email copy, designing emails, choosing a platform, or pulling benchmarks. Covers AI email automation, flows, deliverability…
catalyst-center-readonly
Query Cisco Catalyst Center read-only — device inventory, site hierarchy, wireless, assurance health, compliance, software images, events. All 514 read-only API operations reachable through 8 grouped dispatchers. Use when asked what Catalyst Center manages, where a device sits, what its health or compliance state is…
playwright-best-practices
Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions…
huawei-cloud-ucs-policy-governor
Huawei Cloud UCS (Ubiquitous Cloud Native Service) policy governance and compliance management skill using hcloud CLI. Use this skill when the user wants to: (1) manage UCS policy instances - create/update/query/delete, (2) manage UCS policy definitions - query/list, (3) enable/disable policies on clusters or fleet…
cis-aws-compute-2.14
Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches.
ebpf-observability
Use eBPF for deep kernel-level observability — trace syscalls, network flows, and application behavior without code changes using Cilium, Tetragon, and bpftrace.