Skip to content
Get packs

Email Security & Phishing Analysis

Guides an agent through authorized phishing analysis and email authentication (SPF/DKIM/DMARC) review.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
2 files

What it does

When installed, the agent follows a structured checklist for reviewing suspicious emails: reading full message headers, checking SPF, DKIM and DMARC results, comparing sender and reply addresses for spoofing, and reviewing links and attachments in a sandbox. It can also suggest tenant-level mail protections such as anti-phishing policies, external-sender tagging, MFA and OAuth app consent. It is framed for authorized review only and tells the agent not to re-send malicious samples to real users.

Great for

  • Security staff or IT admins triaging suspicious emails and recording indicators of compromise
  • Administrators reviewing whether a domain's SPF, DKIM and DMARC settings are correctly configured
  • Teams designing authorized phishing-awareness exercises with a clear scope

Skip it if

  • Running phishing tests against third-party domains or real employees without permission, which the skill itself forbids and which may be illegal
  • Anyone expecting a verified malware scanner: the skill only describes steps and points to external tools like urlscan or sandboxes, so results depend on those tools and on human judgement

Try asking

  • “Analyse this suspicious email's full headers and tell me whether SPF, DKIM and DMARC passed”
  • “Review this phishing email for brand impersonation and reply-to mismatches and list the indicators of compromise”
  • “Audit our tenant's anti-phishing, external tagging, MFA and OAuth app consent settings and suggest improvements”
  • “Help me design an authorized phishing-awareness exercise for our internal staff”
Step-by-step guide: how to use Email Security & Phishing AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    email-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip email-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip email-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State clearly that you are authorized to analyse the sample or review the tenant configuration before starting
  • Paste the raw message source rather than a summary so header checks are accurate
  • Treat any URL or attachment as hostile and open it only in an isolated sandbox

What's inside

  • references/email-auth-checklist.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.