email-security
Lets your agent review email security. It analyzes phishing, headers (SPF/DKIM/DMARC), and token abuse.
What it does
This tool helps analyze suspicious emails to identify threats like phishing and fraud. It checks sender authenticity and email content to ensure security.
When to use it
- ✓When you receive an email that looks like a scam.
- ✓To verify if a business email is legitimate.
- ✓To understand how malicious emails work.
Example of what to ask your AI
“Analyze this email to see if it's a phishing scam and what the risks are.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool examines the email's technical details, like the sender and links, and checks if security settings are correct. It can also analyze attachments in a safe environment.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add zhaoxuya520/reverse-skill --skill email-securityOr download just the file:
curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/skills/email-security/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Email Security & Phishing Analysis
ACTION REQUIRED（读完后立刻执行）
NOW: 确认授权（分析样本邮件 / 租户配置评审）NOW: 不向真实用户二次投递恶意样本ACT: 头认证 → 内容/URL → 附件沙箱 → 租户控制面建议
适用场景
- 钓鱼邮件拆解与 IOC
- SPF/DKIM/DMARC 配置评估
- BEC 商务邮件欺诈模式
- OAuth 应用钓鱼 / 邮箱令牌滥用（联合 llm/cloud 身份）
- 安全意识演练设计（授权）
工作流
□ 完整原始头：Received 链、From/Return-Path 一致性
□ SPF/DKIM/DMARC 对齐结果
□ URL 沙箱与附件静态（联合 malware-analysis）
□ 仿冒品牌与回复地址差异
□ 租户：反钓鱼策略、外部标记、MFA、OAuth app 同意
工具链
| 工具 | 用途 |
|---|---|
| 邮件客户端「查看源」 | 头 |
| dig/nslookup | SPF/DMARC 记录 |
| urlscan / 沙箱 | 链接与附件 |
| 租户管理中心 | 策略 |
参考
references/email-auth-checklist.md../malware-analysis/../attack-chain/（钓鱼阶段）../windows-ad/（令牌）
路由上下文
上游: MASTER R36
MUST NOT: 未授权对第三方域群发测试钓鱼
任务完成自检
- 头认证结论是否完整？
- IOC 是否可检测化（联合 threat-hunting）？
- Checklist？
FAQ
What is phishing?
Phishing is a type of scam where criminals try to trick you into revealing personal information, like passwords or bank details, by pretending to be a trustworthy entity.
What are SPF, DKIM, and DMARC?
These are technical checks that help ensure an email truly came from the sender it claims to be from, not an imposter.
Can I use this to analyze any email?
You can use it to analyze suspicious emails, but the tool is most effective when used for authorized security purposes, such as in a corporate environment.
Details
Original description by the author
Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
Popularity
- GitHub stars
- 42k
- Ranking position
- #4764
- License
- MIT
- Updated
- 9/22/2026
Comments
- …
More skills from this repository
competition-ad-certificate-abuse
Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.
zhaoxuya520/reverse-skill
competition-agent-cloud
Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.
zhaoxuya520/reverse-skill
competition-android-hooking
Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.
zhaoxuya520/reverse-skill
competition-browser-persistence
Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.
zhaoxuya520/reverse-skill
Similar skills
django-security
Helps your agent implement security practices in Django applications. It focuses on authentication, authorization, and prevention against common attacks, ensuring more secure code.
affaan-m/ECC
laravel-security
Helps your agent secure Laravel applications against threats. Implements security practices for authentication, authorization, and common attack prevention.
affaan-m/ECC
module-regression
Helps your agent manage changes in large projects. Ensures code changes in one part don't break other parts.
affaan-m/ECC