Attachments · MachineMail Docs

High risk

Every attachment gets an entry in trust.attachments with a risk of low, medium or high, the reasons behind it, and for text-like files the extracted_text.

JSON Example

{
  "attachment_id": "att_...",
  "filename": "invoice.pdf.exe",
  "content_type": "application/pdf",
  "risk": "high",
  "reasons": ["Executable or script file type .exe", "Double extension .pdf.exe disguises the real file type", "Content confirmed as Windows executable (PE)"]
}

Risk is decided from three things: the file name, the content type the sender declared, and the first bytes of the file itself. The highest risk any check raises wins.

High risk

Check Example reason
Executable or script extension: .exe, .scr, .bat, .cmd, .msi, .dll, .jar, .js, .vbs, .hta, .ps1, .sh, .app, .apk, .lnk, .iso, .img, .vhd, .dmg, .pkg, .one, .py, .chm, .url, .reg and about sixty more Executable or script file type .exe
Macro-enabled Office file: .docm, .xlsm, .pptm, .xlsb and similar Macro-enabled Office document .docm
HTML or SVG file: .html, .htm, .svg, .mht and similar, which can render a fake sign-in page locally .html attachment can render a credential-harvesting page locally
Double extension hiding the real type Double extension .pdf.exe disguises the real file type
Name padded with spaces before the extension Filename padded with whitespace to hide the extension
Right-to-left override character in the name, which makes an .exe display as if it ended in .pdf Filename contains a right-to-left override that disguises the real extension
Executable content type, such as application/x-msdownload or anything JavaScript, VBScript, Python or Perl Executable content type application/x-msdownload
text/html content attached under a non-HTML name HTML content attached as a file
Bytes that are a Windows, Linux or macOS executable under a non-executable name File content is a Windows executable (PE) despite its .pdf name
Bytes that are a Windows shortcut, a disk image, a #! script or HTML under another name File content is a disk image
An Office file containing a VBA macro project Office document contains a VBA macro project
A PDF with a /Launch action PDF contains a Launch action

Medium risk

Check Example reason
Archive: .zip, .rar, .7z, .gz, .tar and similar, which can hide executables from scanners Archive .zip can hide executables from scanners
Legacy Office format: .doc, .xls, .ppt, .rtf and similar Legacy Office format .doc can carry macros or exploits
Archive content type under a non-archive name Archive content type application/zip
Bytes of one known type under another type’s extension File content is PDF but the name says .docx
A PDF containing JavaScript or embedded files PDF contains JavaScript
Declared content type that does not match the extension Content type text/plain does not match .pdf
An unnamed binary attachment Unnamed binary attachment

Everything else, such as an ordinary PDF, PNG or DOCX whose bytes match its name, is low.

Extracted text

extracted_text is filled for attachments MachineMail can read as text:

Invisible characters are removed from the extracted text and it is cut at 100,000 characters. Up to 20,000 characters of extracted text across all attachments is scanned by the classifier, so instructions to an AI hidden in an attached file raise contains_instructions_to_agent just as they would in the body.

How attachments feed the verdict

Using attachment reports in an agent

Download an attachment with GET /v0/inboxes/{inbox_id}/messages/{message_id}/attachments/{attachment_id} only when the task needs it, and check its report first:

const report = message.trust.attachments.find((a) => a.attachment_id === attachmentId);
if (!report || report.risk !== 'low') throw new Error('Refusing to open a risky attachment');

Prefer extracted_text over opening the file yourself, and treat it as untrusted content, exactly like the body.