skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

email-security

Analyzes phishing emails, header authentication, and BEC patterns for authorized security reviews.

21|8|Updated Aug 3, 2026
Search Tags:#email security#header analysis#ioc extraction#spf dkim dmarc#phishing analysis#bec detection#oauth phishing
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill email-security-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-security
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/email-security
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill email-security-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security teams need a repeatable, authorized workflow for dissecting phishing emails, validating sender authentication, and assessing tenant-level email defenses instead of ad-hoc manual inspection. ## Core Features & Use Cases - Phishing Email Analysis: Parse full original headers, Received chains, and From/Return-Path consistency to extract IOCs. - Authentication Review: Evaluate SPF, DKIM, and DMARC alignment using a structured checklist. - BEC & Token Abuse Detection: Identify business email compromise patterns, OAuth app phishing, and mailbox token abuse. - Use Case: Given a suspicious email sample, walk through header authentication, sandbox URLs and attachments, then produce tenant policy recommendations such as anti-phishing rules, external tagging, MFA, and OAuth consent controls. ## Quick Start Analyze this suspicious email sample for phishing indicators, check its SPF, DKIM, and DMARC alignment, and recommend tenant protections.

Frequently Asked Questions about email-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a phishing email header?▼

Phishing header analysis starts with the full original headers, tracing the Received chain and checking From/Return-Path consistency. Then verify SPF, DKIM, and DMARC alignment results to determine whether the sender domain was spoofed.

How to check SPF, DKIM, and DMARC records for a domain?▼

Use dig or nslookup to query the domain's TXT records for SPF and DMARC policies, and query the DKIM selector for the signing key. Check SPF -all/~all qualifiers, DMARC p= policy and rua reporting, and alignment mode (relaxed or strict).

What tools are used for phishing URL and attachment analysis?▼

URL sandboxing services like urlscan and dedicated malware sandboxes detonate links and attachments safely. Static attachment analysis can be coordinated with a malware-analysis workflow, and results feed into IOC extraction.

Can this workflow detect business email compromise attacks?▼

Yes, it covers BEC patterns including display-name spoofing, reply-to address mismatches, and lookalike branding. It also addresses OAuth app phishing and mailbox token abuse in coordination with identity-focused reviews.

What are the authorization requirements for email security testing?▼

The workflow requires confirmed authorization before analyzing samples or reviewing tenant configurations, and prohibits redelivering malicious samples to real users or sending unauthorized test phishing to third-party domains.

Related Skills

Explore More Software Engineering Skills→
NiravenNiraven

email-prompt-injection-defense

Detect and prevent prompt injection attacks in email content.

Community
Intermediate
riparinoriparino
1

defensive-oauth

Detect OAuth abuse and consent-related security incidents in Entra ID environments.

Community
Advanced
xalgordxalgord
954

conducting-phishing-incident-response

Investigates phishing emails, extracts indicators, purges malicious messages, and remediates compromised accounts.

Community
Advanced
xalgordxalgord
954

investigating-phishing-email-incident

Investigates phishing email incidents through header analysis, URL detonation, scope assessment, and containment.

Community
Advanced