Email Security & Phishing Analysis
Unverified●30/40Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor◐PartialPlain prose you can paste in — but no Cursor rules file
Codex◐PartialPlain prose you can paste in — but no AGENTS.md
Gemini CLI◐PartialPlain prose you can paste in
Copilot◐PartialPlain prose you can paste in — but no Copilot instructions file
npx agentalley add email-securityWho is stuck, and on what
You got an email that looks like it's from your bank, a supplier, or your boss asking for money or a login, and something feels off but you can't tell if it's real. One wrong click could cost you money or hand over your accounts.
What it gives you
A clear safe-or-scam verdict with the exact red flags found and a short list of what to do next.
When NOT to use it
It will not recover an account or reverse money you've already sent or clicked through.
The whole source
Frontmatter — 2 properties
| name | email-security |
|---|---|
| description | Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research. |
| 1 | --- |
| 2 | name: email-security |
| 3 | description: Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research. |
| 4 | ---A5 — No allowed-tools declared — no way to tell what this skill may touch |
| 5 | |
| 6 | # Email Security & Phishing Analysis |
| 7 | |
| 8 | ## ACTION REQUIRED（读完后立刻执行） |
| 9 | |
| 10 | 1. `NOW`: 确认授权（分析样本邮件 / 租户配置评审） |
| 11 | 2. `NOW`: 不向真实用户二次投递恶意样本 |
| 12 | 3. `ACT`: 头认证 → 内容/URL → 附件沙箱 → 租户控制面建议 |
| 13 | |
| 14 | ## 适用场景 |
| 15 | |
| 16 | - 钓鱼邮件拆解与 IOC |
| 17 | - SPF/DKIM/DMARC 配置评估 |
| 18 | - BEC 商务邮件欺诈模式 |
| 19 | - OAuth 应用钓鱼 / 邮箱令牌滥用（联合 llm/cloud 身份） |
| 20 | - 安全意识演练设计（授权） |
| 21 | |
| 22 | ## 工作流 |
| 23 | |
| 24 | ```text |
| 25 | □ 完整原始头：Received 链、From/Return-Path 一致性 |
| 26 | □ SPF/DKIM/DMARC 对齐结果 |
| 27 | □ URL 沙箱与附件静态（联合 malware-analysis） |
| 28 | □ 仿冒品牌与回复地址差异 |
| 29 | □ 租户：反钓鱼策略、外部标记、MFA、OAuth app 同意 |
| 30 | ``` |
| 31 | |
| 32 | ## 工具链 |
| 33 | |
| 34 | | 工具 | 用途 | |
| 35 | |------|------| |
| 36 | | 邮件客户端「查看源」 | 头 | |
| 37 | | dig/nslookup | SPF/DMARC 记录 | |
| 38 | | urlscan / 沙箱 | 链接与附件 | |
| 39 | | 租户管理中心 | 策略 | |
| 40 | |
| 41 | ## 参考 |
| 42 | |
| 43 | - `references/email-auth-checklist.md` |
| 44 | - `../malware-analysis/` `../attack-chain/`（钓鱼阶段） `../windows-ad/`（令牌） |
| 45 | |
| 46 | ## 路由上下文 |
| 47 | |
| 48 | **上游**: MASTER R36 |
| 49 | **MUST NOT**: 未授权对第三方域群发测试钓鱼 |
| 50 | |
| 51 | ## 任务完成自检 |
| 52 | |
| 53 | - [ ] 头认证结论是否完整？ |
| 54 | - [ ] IOC 是否可检测化（联合 threat-hunting）？ |
| 55 | - [ ] Checklist？ |
Reviews
Installed this one?Write the first review and take the Trailblazer badge.
Alternatives
Structure Your Invention For A Patent FilingDescribe your invention in plain words and get back a formal write-up that lays out the problem it solves, how it works, and which parts are worth protecting.●····●37/40Claims Drafting: The Core Patent SkillDescribe your invention in plain words and get back a numbered set of formal patent claims — the legal wording that defines exactly what you own.●····●36/40Patent Novelty and Non-Obviousness CheckDescribe your invention in everyday words and get back a clear read on whether it's new and original enough to patent, plus where it might hit trouble.●····●35/40Patent Pipeline: From Invention to FilingDescribe your invention in plain words and get back a complete first-draft patent application — claims, full description, and abstract — ready to hand to a patent attorney.●····●35/40