Guide · Agent skill
How to use the email-security agent skill for phishing analysis
Updated · written with AI from the project's own documentation and checked against our catalogue data
The email-security skill gives an AI agent a structured checklist for reviewing suspicious emails and auditing a mail domain's authentication settings. It is written for security staff, IT administrators and teams planning authorized phishing-awareness exercises. After this guide you will know what the skill does, how to install it, how to ask for help in plain language, and which safety limits apply.
Email Security & Phishing Analysiszhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download the ZIP. Download the email-security skill ZIP from this page.
- 2Unzip into a skills folder. Extract it to ~/.claude/skills/ for personal use, or to .claude/skills/ inside a project.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Confirm authorization. State what you are authorized to review, whether a sample message or tenant configuration.
- 5Provide the raw source. Export the full message source from your email client, or give the domain name for SPF, DKIM and DMARC review.
- 6Run the checklist. Ask for header analysis, authentication results, spoofing checks and link or attachment review through a sandbox.
- 7Record the results. Save the indicators of compromise and tenant recommendations, and have a human analyst verify them.
What the email-security skill makes the agent do
Once installed, the agent follows a fixed review order for email. It reads the full message headers, including the Received chain and whether the From and Return-Path addresses agree. It then checks the SPF, DKIM and DMARC alignment results, compares the display name and reply address for spoofing, and reviews links and attachments by pointing you to a URL or attachment sandbox such as urlscan.
The skill also covers tenant-level protections. It can suggest anti-phishing policies, external-sender tagging, MFA and OAuth app consent review. It covers business email compromise (BEC) patterns, OAuth application phishing and mailbox token abuse, and it can help design authorized phishing-awareness exercises.
The skill is framed for authorized review only. It tells the agent to confirm authorization first and not to re-send malicious samples to real users.
How to install the email-security skill
Download the ZIP for the email-security skill from this page. Unzip it into one of two locations: your personal skills folder at ~/.claude/skills/, or a project-specific .claude/skills/ folder inside the project you work in. The package contains SKILL.md and references/email-auth-checklist.md.
You can also upload the skill through the Claude apps. Open Settings, go to Capabilities, then Skills, and add the skill there.
- Personal install: ~/.claude/skills/ (available across your projects)
- Project install: .claude/skills/ inside the project folder (shared with that project)
- Claude apps: Settings → Capabilities → Skills (upload)
How to trigger the skill with natural requests
You do not need a special command. Describe the task in plain language that mentions email, phishing, headers, SPF, DKIM, DMARC, BEC or the mail tenant, and say what you are authorized to review. The agent should then apply the checklist.
Good requests state the scope: the sample you have, whether it is a single message or a tenant configuration, and what output you want, such as a list of indicators of compromise (IOCs).
- Analyze this suspicious email header I exported from my mail client and tell me whether SPF, DKIM and DMARC passed.
- I am authorized to review our domain. Check whether our SPF, DKIM and DMARC records are configured correctly.
- Triage this phishing email and list the indicators of compromise I should record.
- Suggest tenant-level protections against OAuth app consent phishing for our mail tenant.
What you need before you start
The skill assumes a few tools. You need an email client that can show the raw message source, so the agent can read full headers. You need dig or nslookup to look up SPF and DMARC DNS records. An external URL or attachment sandbox such as urlscan is optional but useful for links and files. Admin console access to your mail tenant is optional and only needed for the policy review part.
The skill's own file list shows that it runs no scripts. It does use the network, because lookups and sandbox services are external.
- Email client that can show raw message source (required for header analysis)
- dig or nslookup for DNS record lookups
- External URL/attachment sandbox such as urlscan (optional)
- Admin console access to the mail tenant (optional, for policy review)
Safety notes: scripts, network and authorization
Keep the scope tight. The skill forbids running phishing tests against third-party domains or against real employees without permission, and such tests may be illegal. Do not forward malicious samples to real users. Only analyze messages and domains you are authorized to review.
The skill runs no scripts, but it does use the network. Any URL or attachment you send to an external sandbox is shared with that service, so check your organization's policy before uploading sensitive mail. Remember also that the skill describes steps and points to outside tools. It does not scan for malware itself, so results depend on those tools and on your judgement.
- Runs scripts: no
- Uses network: yes (DNS lookups, external sandboxes)
- Authorization required before any analysis or exercise
- Never re-send malicious samples to real users
Tips for better results
Export the full raw source of the message rather than a summary, because the agent needs the complete Received chain and authentication results. For domain reviews, give the agent the domain name and the SPF, DKIM and DMARC details you looked up.
Use the checklist in references/email-auth-checklist.md as a shared record. It covers the SPF record and its -all or ~all policy, DKIM selector validity, the DMARC p= policy and rua reporting, relaxed or strict alignment, display-name spoofing and reply-address mismatch, and the outbound gateway and relays. Treat the agent's output as a draft for a human analyst to verify.
- Paste or attach the complete raw message source
- Name the domain when asking for SPF, DKIM or DMARC review
- Check the references/email-auth-checklist.md items one by one
- Ask the agent to make IOCs detectable for threat hunting
What people use it for
- Triaging a reported phishing email and recording its indicators of compromise
- Checking whether a domain's SPF, DKIM and DMARC settings are correctly configured
- Spotting display-name spoofing and reply-address mismatches in a business email compromise attempt
- Reviewing tenant protections such as anti-phishing policies, external-sender tagging, MFA and OAuth app consent
- Designing a scoped, authorized phishing-awareness exercise
Frequently asked questions
How do I install the email-security agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Is the email-security skill free?
This page does not state pricing or licence terms beyond the skill's listed licence, which is MIT. Check the repository's licence file for the full terms before reuse.
What do I need to use the email-security skill?
You need an email client that can show raw message source and dig or nslookup for DNS lookups. An external sandbox such as urlscan and admin access to your mail tenant are optional.
Does the email-security skill scan for malware?
No. The skill describes review steps and points to external tools such as urlscan or sandboxes. Results depend on those tools and on human judgement.
Can I use the skill to test phishing on employees or other domains?
Only with permission and a clear scope. The skill forbids running phishing tests against third-party domains or real employees without permission, which may be illegal.
How is this different from a manual header check or a dedicated email security product?
The skill gives an agent a structured checklist for reading headers, checking SPF, DKIM and DMARC, and suggesting tenant controls. It does not replace a dedicated scanner or the judgement of an analyst, so use it as a guided review process.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security staff member or IT administrator who triages suspicious email, reviews SPF, DKIM and DMARC configuration, or plans authorized phishing-awareness exercises. Pick a dedicated email security product or managed scanner if you need automated malware verification or continuous monitoring, because this skill only describes steps and relies on external tools.
Download the skill