TP: If you can ensure that inbox rule was designed by an OAuth third-occasion app with suspicious scopes sent from an unfamiliar source, then a real positive is indicated.