# Email Header Phishing Analysis

> Draft · awaiting review.

> One skill from a large community collection: parses email headers to trace a phishing message and check SPF, DKIM and DMARC.

- Badge: `reach 2 · not run yet`
- Type: Skill; tier: not run yet
- Tasks: Email and phishing analysis; mission: Defensive; works with: Claude Code, Codex, Cursor, Gemini CLI, Copilot
- Source: https://github.com/mukul975/Anthropic-Cybersecurity-Skills (skills/analyzing-email-headers-for-phishing-investigation), pinned to `101ca0b` (v1.3.0), licence Apache-2.0
- Last checked: 2026-10-19; next check: 2027-01-17; method v0.1, reach-v0.1

## At a glance

- **What it is:** A skill that has the AI agent parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity and identify spoofing through SPF, DKIM and DMARC validation. A skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it.
- **Made for:** Verifies sender authenticity and identifies spoofing through SPF, DKIM and DMARC validation. +1 more
- **Runs:** Inside your AI client: its model follows the instructions and works with the client's own tools. Other modes: standalone script (on your machine, started by you).
- **Sends data to:** Sender domain DNS (by default), whois servers (by default), AbuseIPDB (by default), VirusTotal (by default), VirusTotal URL Scan (if you turn it on), URLhaus or PhishTank (if you turn it on), PyPI (if you turn it on), VirusTotal (if you turn it on). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, runs commands, sends data out, according to the capabilities read.
- **Needs:** Python with email parsing libraries · The DNS lookup tools dig or nslookup for SPF, DKIM and DMARC checks · Raw headers of the suspicious message in EML or MSG format · +5 more

Profile read at commit `101ca0b` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

A skill that has the AI agent parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity and identify spoofing through SPF, DKIM and DMARC validation. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L3-4)

Made for (the author says):

- Verifies sender authenticity and identifies spoofing through SPF, DKIM and DMARC validation. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L4)
- Gives an AI agent the workflow a senior analyst follows: when to use a technique, what prerequisites to check, how to execute step by step and how to verify results. (README.md#L142)

Documented uses:

- Investigate a suspected phishing email to determine its true origin. [Email and phishing analysis] (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L66)
- Support incident response after a user has clicked a phishing link. [Incident response and forensics (DFIR)] (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L68)
- Trace the delivery path and relay servers of a suspicious email. [Email and phishing analysis] (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L69)
- Validate SPF, DKIM and DMARC alignment to identify forged senders. [Email and phishing analysis] (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L70)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| Step 1: Extract Raw Email Headers | Names where Outlook, Gmail and Thunderbird show raw headers and copies an EML file from a mounted forensic image into /cases/case-2024-001/email/. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L82-91) | reads, changes, runs commands | yes |
| Step 2: Parse the Email Header Chain | Prints From, To, Subject, Return-Path, X-Originating-IP and similar fields, the Received hops bottom-up, Authentication-Results, ARC, Received-SPF and DKIM-Signature. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L118) | reads, runs commands | yes |
| Step 3: Validate SPF, DKIM, and DMARC Records | Runs dig TXT lookups for SPF, the DKIM selector and _dmarc, an SPF check of the sending IP with pyspf spf.check2, and an AbuseIPDB reputation query. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L158) | reads, runs commands | yes |
| Step 4: Analyze Sender Domain and Infrastructure | Runs whois, dig A/MX/NS and reverse DNS, a Levenshtein lookalike-domain check, a VirusTotal domain lookup and a From versus Reply-To comparison. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L200) | reads, runs commands | yes |
| Step 5: Examine Email Body and Attachments | Extracts URLs from the body, flags links whose display text differs from the href, hashes attachments with SHA-256 and saves them to the case folder. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L249) | reads, changes, runs commands | yes |
| Email Header Phishing Analysis Agent | Parses the EML file given as argument and prints From, To, Subject, Date, hop IPs, SPF/DKIM/DMARC verdicts, a URL count, href mismatches, attachment hashes and indicators. (skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L187-196) | reads | no |
| API Reference: Email Header Analysis Tools | Reference for the email module, dig, pyspf, dkimpy dkim.verify, AbuseIPDB, VirusTotal domain lookup, VirusTotal URL Scan POST and whois. (skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L103-107) | reads, sends data out | no |
| Output Format | Report template with headers, delivery path hops, SPF/DKIM/DMARC results, phishing indicators and a risk level. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L334-337) |  | yes |
| dns_lookup | The agent.py helper dns_lookup runs dig <record type> <domain> +short through subprocess.run with a 10-second timeout. (skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L147-153) | reads, runs commands | no |

## How it runs

SKILL.md holds frontmatter and a five-step Workflow that the client's model executes step by step with bash, dig, whois, curl and inline python3 on the user's machine; Steps 3 and 4 curl AbuseIPDB and VirusTotal; scripts/agent.py parses EML files locally. (README.md#L197)

- Starts: Inside your AI client: its model follows the instructions and works with the client's own tools. Loads into Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI and other agentskills.io clients, whose model follows it. (README.md#L108)
- Can also run: On your machine, started by you (standalone script, switch `python agent.py <email.eml>`). The bundled scripts/agent.py runs as a standalone Python command against one EML file. (skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L228)
- Your AI client: **SKILL.md**: Skill definition with frontmatter, When to Use, Prerequisites, a five-step Workflow and an Output Format. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L2)
- Your AI client: **references/api-reference.md**: Reference file with commands and API calls for email parsing, DNS, SPF, DKIM, AbuseIPDB, VirusTotal and whois. (skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L1)
- Your machine: **scripts/agent.py**: Python script that parses an EML file and prints header, authentication, URL, attachment and indicator results. (skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L2)
- Your machine: **/cases/case-2024-001/email**: Case folder holding the EML or PST evidence, extracted header files and saved attachments. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L126)
- Your machine: **/mnt/evidence forensic image**: Mounted forensic image from which Step 1 copies the suspect's Outlook EML file into the case folder. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L89-91)
- Outside your machine: **DNS and whois servers**: DNS and whois services queried for SPF, DKIM, DMARC, A, MX, NS, reverse DNS and registration data of the sender. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L173)
- Outside your machine: **AbuseIPDB and VirusTotal**: Reputation services queried for the sending IP and sender domain with user-supplied API keys. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L194-197)
- Sends data to Sender domain DNS (your targets, by default): dig queries the sender domain's TXT records (SPF, DKIM selector, _dmarc), its A, MX and NS records, and reverse DNS of the sending IP. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L165)
- Sends data to whois servers (other, by default): whois fetches registrar, creation, expiration, registrant and nameserver data for the sender domain. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L204)
- Sends data to AbuseIPDB (vendor API, by default): Sends the sending IP to the AbuseIPDB check endpoint with the user's API key. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L196)
- Sends data to VirusTotal (vendor API, by default): Sends the sender domain to the VirusTotal domains endpoint with the user's API key. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L232)
- Sends data to VirusTotal URL Scan (vendor API, if you turn it on): The API reference documents a POST that submits a URL to VirusTotal for scanning. (skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L103-107)
- Sends data to URLhaus or PhishTank (vendor API, if you turn it on): Step 5 comments direct submitting URLs found in the body to URLhaus or PhishTank for a reputation check. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L291)
- Sends data to PyPI (download, if you turn it on): Downloads the pypff package with pip when a PST file has to be processed. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L93-94)
- Sends data to VirusTotal (vendor API, if you turn it on): A Step 5 comment directs submitting attachment hashes to VirusTotal. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L290)

## What you need

- Runtime: Python with email parsing libraries. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L77)
- Other tools: The DNS lookup tools dig or nslookup for SPF, DKIM and DMARC checks. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L75)
- Other: Raw headers of the suspicious message in EML or MSG format. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L73)
- Account: Access to threat intelligence platforms for IP and domain reputation. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L78)
- Credentials: A VirusTotal API key, passed in the x-apikey header of the curl call. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L233)
- Credentials: An AbuseIPDB API key, passed in the Key header of the curl call. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L197)
- Other tools: The pyspf Python package for the SPF check. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L182)
- Other tools: The python-Levenshtein package for the lookalike-domain check. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L218)
- Installer: The recommended install runs npx skills add mukul975/Anthropic-Cybersecurity-Skills, naming the repository with no version, tag or commit. (README.md#L100-101)
- Installer: The alternative install clones the full repository's default branch with git clone. (README.md#L103-105)
- Installer: Step 1 of the workflow runs pip install pypff without a version pin when a PST file is processed. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L93-94)
- Installer: The skill is part of a repository of 817 skills across 29 security domains, and the README tells users to clone that repository and point the agent at it. (README.md#L41)

## Limits and risks

- Step 5 writes each attachment under /cases/case-2024-001/email/attachments/ using the filename from the message's MIME part (part.get_filename()) as the path component. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L279-286)
- When extract_attachments in scripts/agent.py gets an output_dir, it joins it with the attachment filename from the message via os.path.join before writing. (skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L137-141)
- Step 3 sets SENDER_DOMAIN for the envelope sender domain and expands it unquoted in shell lines such as dig TXT $SENDER_DOMAIN +short. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L161-165)
- scripts/agent.py takes SPF, DKIM and DMARC verdicts from the message's existing Authentication-Results headers. (skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L47-49)
- scripts/agent.py reads its input as a text EML file with email.message_from_file. (skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L14-17)
- Scenario 4 describes phishing sent through a legitimate email marketing service where SPF and DKIM pass, which requires URL and content analysis rather than header authentication checks. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L332)
- The Key Concepts table states that attackers can forge From, Reply-To and other headers but not Received chains. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L305)
- The README describes the repository as an independent community project not affiliated with Anthropic PBC. (README.md#L35)
- Step 1 writes the transport headers of each PST message to /cases/case-2024-001/email/ under a filename that includes the first 30 characters of the message subject. (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L104-110)
- The Step 3 pyspf check calls spf.check2 with fixed example values for IP, sender and HELO name (203.0.113.45, sender@example-corp.com, mail.example-corp.com). (skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L184-188)

## Rights in plain language

- Declared: nothing.
- Code: reach 2 (open): files 2 (writes outside the project), network 2 (talks to any host), execution 2 (runs shell commands or eval), secrets 2 (reads broad tokens or the environment), persistence 2 (changes config or installs globally).
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 2 (open).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | not declared | 2 writes outside the project | not run yet |
| Network: whom does it talk to? | not declared | 2 talks to any host | not run yet |
| Execution: what does it run? | not declared | 2 runs shell commands or eval | not run yet |
| Secrets: which credentials does it touch? | not declared | 2 reads broad tokens or the environment | not run yet |
| Persistence: what survives the run? | not declared | 2 changes config or installs globally | not run yet |
| Approval: does it ask before acting? | not declared | 0 asks each time | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L101` at the pinned commit (not a command to copy): `npx skills add mukul975/Anthropic-Cybersecurity-Skills`


### Run it with least privilege

- claude code: `permissions.allow: [Read, Grep]; supply reputation API keys only if you use the optional VirusTotal and AbuseIPDB steps, quote header values before passing them to a shell, and save attachments under their hash instead of the file name given in the email`
- note: `derived from the code, not tested in the lab`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Email Header Phishing Analysis declare?**

nothing.

**What does its code suggest?**

reach 2 (open): files 2 (writes outside the project), network 2 (talks to any host), execution 2 (runs shell commands or eval), secrets 2 (reads broad tokens or the environment), persistence 2 (changes config or installs globally).

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-08-31; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: claude_code: permissions.allow: [Read, Grep]; supply reputation API keys only if you use the optional VirusTotal and AbuseIPDB steps, quote header values before passing them to a shell, and save attachments under their hash instead of the file name given in the email; note: derived from the code, not tested in the lab

Method: https://readbeforerun.ai/method/