# SMTP Command Injection

> Detects user-controlled input in SMTP commands that can inject malicious SMTP commands via CRLF sequences.

- Skill: `zakirkun/smtp-command-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/smtp-command-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/smtp-command-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/smtp-command-injection

---


# SMTP Command Injection

## Overview
SMTP command injection (distinct from email header injection) occurs when user input is placed directly in raw SMTP protocol commands. By injecting CRLF sequences, attackers can:
- Add additional RCPT TO commands (spam relay)
- Send emails to unintended recipients
- Inject arbitrary SMTP commands (VRFY, EXPN, DATA)

## Remediation
- Use email library abstractions that handle SMTP protocol internally
- Strip CRLF characters from all email fields before SMTP transmission
- Validate sender/recipient addresses with strict RFC-compliant regex