Skip to content
Get packs

Email Header Phishing Analyzer

Traces a suspicious email's true origin by reading its headers and checking SPF, DKIM and DMARC.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can take the raw headers of a suspicious email and walk through them step by step: which servers the message passed through, whether the sender's domain vouches for it (SPF, DKIM, DMARC), and whether the sending address or domain looks forged or lookalike. It follows a written investigation procedure and can run a helper Python script to parse .eml files and pull out key fields. The result is a structured verdict on whether the sender was likely spoofed.

Great for

  • Security analysts triaging user-reported phishing emails
  • Incident responders checking whether a message was spoofed after a click
  • IT staff learning how to read email headers and authentication results

Skip it if

  • Analyzing a live mailbox without authorization, since it handles private correspondence and forensic evidence (legal and privacy risk)
  • Replacing a full email security gateway or SOC tooling, because header checks are one signal and can be wrong for forwarded or mailing-list mail

Try asking

  • “Here is the raw header of a suspicious invoice email. Did it really come from vendor.com?”
  • “Trace the Received chain of this reported phishing message and tell me which server it originated from.”
  • “Check the SPF, DKIM and DMARC results on this email and explain whether the sender was spoofed.”
  • “Look at this domain for lookalike or typosquatting signs compared with our company domain.”
Step-by-step guide: how to use Email Header Phishing AnalyzerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-email-headers-for-phishing-investigation.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-email-headers-for-phishing-investigation.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-email-headers-for-phishing-investigation.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Paste the full original headers (Show original / Message Source), not just the visible From line, so the Received chain and authentication results are complete.
  • Treat the outcome as evidence, not proof: forwarded and mailing-list mail can legitimately fail SPF, so combine results with the message content.
  • Review any script the agent proposes before running it, and keep API keys out of chat logs and shared case files.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.