Email Header Phishing Analysis

Draft · awaiting review

One skill from a large community collection: parses email headers to trace a phishing message and check SPF, DKIM and DMARC.

For Email and phishing analysisWorks with Claude Code, Codex, Cursor, Gemini CLI, CopilotMaintained mukul975, last push 2026-08-31

SkillA skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it. by mukul975 · read from the code at 101ca0b (v1.3.0) on 2026-10-19The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

Level 2. Files. Writes attachments to an absolute path outside the working directory, using a filename taken from the email.
SKILL.md L286
Level 2. Network. Sends the sender domain to the VirusTotal API and L196 the sending IP to AbuseIPDB.
SKILL.md L232
Level 2. Execution. Shell pipeline with a value taken from the email.
SKILL.md L204
Level 2. Secrets. VirusTotal API key header, a second user-supplied service key next to the AbuseIPDB key.
SKILL.md L233
Level 2. Persistence. Runs pip install into the active Python environment with no virtual environment.
SKILL.md L94

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

Claude Code: permissions.allow: [Read, Grep]; supply reputation API keys only if you use the optional VirusTotal and AbuseIPDB steps, quote header values before passing them to a shell, and save attachments under their hash instead of the file name given in the email.

What we checked, and what we found Disagree?

Skill · code showsreach 2 · open

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for: Verifies sender authenticity and identifies spoofing through SPF, DKIM and DMARC validation.
Gives an AI agent the workflow a senior analyst follows: when to use a technique, what prerequisites to check, how to execute step by step and how to verify results.
Use it when: Investigate a suspected phishing email to determine its true origin Email and phishing analysis
Support incident response after a user has clicked a phishing link Incident response and forensics (DFIR)
Trace the delivery path and relay servers of a suspicious email Email and phishing analysis
Validate SPF, DKIM and DMARC alignment to identify forged senders Email and phishing analysis
Not for: Nothing excluded by the author in the files read
You need: Python with email parsing libraries
The DNS lookup tools dig or nslookup for SPF, DKIM and DMARC checks
Raw headers of the suspicious message in EML or MSG format
+5 more
Details: You need

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

npx skills add mukul975/Anthropic-Cybersecurity-Skills
Quoted from README.md#L101 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

claude code: permissions.allow: [Read, Grep]; supply reputation API keys only if you use the optional VirusTotal and AbuseIPDB steps, quote header values before passing them to a shell, and save attachments under their hash instead of the file name given in the email
note: derived from the code, not tested in the lab

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.Markdown JSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit 101ca0b on 2026-10-25: 57 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, runs commands, sends data out, according to the capabilities read.

What it can do, by group
Group	What it covers	Effect	On by default
Step 1: Extract Raw Email Headers	Names where Outlook, Gmail and Thunderbird show raw headers and copies an EML file from a mounted forensic image into /cases/case-2024-001/email/. SKILL.md L82-91, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L82-91 at the checked commit	reads, changes, runs commands	yes
Step 2: Parse the Email Header Chain	Prints From, To, Subject, Return-Path, X-Originating-IP and similar fields, the Received hops bottom-up, Authentication-Results, ARC, Received-SPF and DKIM-Signature. SKILL.md L118, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L118 at the checked commit	reads, runs commands	yes
Step 3: Validate SPF, DKIM, and DMARC Records	Runs dig TXT lookups for SPF, the DKIM selector and _dmarc, an SPF check of the sending IP with pyspf spf.check2, and an AbuseIPDB reputation query. SKILL.md L158, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L158 at the checked commit	reads, runs commands	yes
Step 4: Analyze Sender Domain and Infrastructure	Runs whois, dig A/MX/NS and reverse DNS, a Levenshtein lookalike-domain check, a VirusTotal domain lookup and a From versus Reply-To comparison. SKILL.md L200, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L200 at the checked commit	reads, runs commands	yes
Step 5: Examine Email Body and Attachments	Extracts URLs from the body, flags links whose display text differs from the href, hashes attachments with SHA-256 and saves them to the case folder. SKILL.md L249, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L249 at the checked commit	reads, changes, runs commands	yes
dns_lookup	The agent.py helper dns_lookup runs dig <record type> <domain> +short through subprocess.run with a 10-second timeout. agent.py L147-153, skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L147-153 at the checked commit	reads, runs commands	no, optional
API Reference: Email Header Analysis Tools	Reference for the email module, dig, pyspf, dkimpy dkim.verify, AbuseIPDB, VirusTotal domain lookup, VirusTotal URL Scan POST and whois. api-reference.md L103-107, skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L103-107 at the checked commit	reads, sends data out	no, optional
Email Header Phishing Analysis Agent	Parses the EML file given as argument and prints From, To, Subject, Date, hop IPs, SPF/DKIM/DMARC verdicts, a URL count, href mismatches, attachment hashes and indicators. agent.py L187-196, skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L187-196 at the checked commit	reads	no, optional
Output Format	Report template with headers, delivery path hops, SPF/DKIM/DMARC results, phishing indicators and a risk level. SKILL.md L334-337, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L334-337 at the checked commit	guides only: asks, explains or decides, acts on nothing itself	yes

Where it sends data and who can connect to it

8 outside connections found in the files read: Sender domain DNS, whois servers, AbuseIPDB, VirusTotal, VirusTotal URL Scan, URLhaus or PhishTank, PyPI.

Sender domain DNS your targets, by default. dig queries the sender domain's TXT records (SPF, DKIM selector, _dmarc), its A, MX and NS records, and reverse DNS of the sending IP. SKILL.md L165, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L165 at the checked commit
whois servers other, by default. whois fetches registrar, creation, expiration, registrant and nameserver data for the sender domain. SKILL.md L204, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L204 at the checked commit
AbuseIPDB vendor API, by default. Sends the sending IP to the AbuseIPDB check endpoint with the user's API key. SKILL.md L196, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L196 at the checked commit
VirusTotal vendor API, by default. Sends the sender domain to the VirusTotal domains endpoint with the user's API key. SKILL.md L232, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L232 at the checked commit
VirusTotal URL Scan vendor API, if you turn it on. The API reference documents a POST that submits a URL to VirusTotal for scanning. api-reference.md L103-107, skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L103-107 at the checked commit
URLhaus or PhishTank vendor API, if you turn it on. Step 5 comments direct submitting URLs found in the body to URLhaus or PhishTank for a reputation check. SKILL.md L291, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L291 at the checked commit
PyPI download, if you turn it on. Downloads the pypff package with pip when a PST file has to be processed. SKILL.md L93-94, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L93-94 at the checked commit
VirusTotal vendor API, if you turn it on. A Step 5 comment directs submitting attachment hashes to VirusTotal. SKILL.md L290, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L290 at the checked commit

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

SKILL.md holds frontmatter and a five-step Workflow that the client's model executes step by step with bash, dig, whois, curl and inline python3 on the user's machine; Steps 3 and 4 curl AbuseIPDB and VirusTotal; scripts/agent.py parses EML files locally. README.md L197, README.md#L197 at the checked commit

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

SKILL.md Skill definition with frontmatter, When to Use, Prerequisites, a five-step Workflow and an Output Format. SKILL.md L2, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L2 at the checked commit
references/api-reference.md Reference file with commands and API calls for email parsing, DNS, SPF, DKIM, AbuseIPDB, VirusTotal and whois. api-reference.md L1, skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L1 at the checked commit

Your machine

Programs and files on the machine where you run the tool.

scripts/agent.py Python script that parses an EML file and prints header, authentication, URL, attachment and indicator results. agent.py L2, skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L2 at the checked commit
/cases/case-2024-001/email Case folder holding the EML or PST evidence, extracted header files and saved attachments. SKILL.md L126, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L126 at the checked commit
/mnt/evidence forensic image Mounted forensic image from which Step 1 copies the suspect's Outlook EML file into the case folder. SKILL.md L89-91, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L89-91 at the checked commit

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 2 (open), read from the code. The author says nothing about rights; that is common and is itself a finding. Not run in our lab yet.

Privilege Reach: six rights, each read three ways. Levels 0 to 3; ? means no evidence.
Right	Author sayswhat the author says	Code showswhat static analysis finds	Run showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Code shows: the evidence

Files · 2SKILL.md L286 writes attachments to an absolute path outside the working directory, using a filename taken from the email
Network · 2SKILL.md L232 sends the sender domain to the VirusTotal API and L196 the sending IP to AbuseIPDB
Execution · 2SKILL.md L204 shell pipeline with a value taken from the email
Secrets · 2SKILL.md L233 VirusTotal API key header, a second user-supplied service key next to the AbuseIPDB key
Persistence · 2SKILL.md L94 runs pip install into the active Python environment with no virtual environment
Approval · 0none found: patterns hitl-v0.1 in 4 files at 101ca0b

Valid for commit 101ca0b (v1.3.0) · checked 2026-10-19 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

Step 5 writes each attachment under /cases/case-2024-001/email/attachments/ using the filename from the message's MIME part (part.get_filename()) as the path component. SKILL.md L279-286, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L279-286 at the checked commit
When extract_attachments in scripts/agent.py gets an output_dir, it joins it with the attachment filename from the message via os.path.join before writing. agent.py L137-141, skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L137-141 at the checked commit
Step 3 sets SENDER_DOMAIN for the envelope sender domain and expands it unquoted in shell lines such as dig TXT $SENDER_DOMAIN +short. SKILL.md L161-165, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L161-165 at the checked commit
scripts/agent.py takes SPF, DKIM and DMARC verdicts from the message's existing Authentication-Results headers. agent.py L47-49, skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L47-49 at the checked commit
scripts/agent.py reads its input as a text EML file with email.message_from_file. agent.py L14-17, skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L14-17 at the checked commit
Scenario 4 describes phishing sent through a legitimate email marketing service where SPF and DKIM pass, which requires URL and content analysis rather than header authentication checks. SKILL.md L332, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L332 at the checked commit
The Key Concepts table states that attackers can forge From, Reply-To and other headers but not Received chains. SKILL.md L305, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L305 at the checked commit
The README describes the repository as an independent community project not affiliated with Anthropic PBC. README.md L35, README.md#L35 at the checked commit
Step 1 writes the transport headers of each PST message to /cases/case-2024-001/email/ under a filename that includes the first 30 characters of the message subject. SKILL.md L104-110, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L104-110 at the checked commit
The Step 3 pyspf check calls spf.check2 with fixed example values for IP, sender and HELO name (203.0.113.45, sender@example-corp.com, mail.example-corp.com). SKILL.md L184-188, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L184-188 at the checked commit
Not covered: what it does at runtime. Other connections not ruled out: read in the documentation and the cited code, not searched in full.

What you need and what the documented installer does

What you need
Kind	What
AI client	Claude Code, Codex, Cursor, Gemini CLI, Copilot
Runtime	Python with email parsing libraries. SKILL.md L77, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L77 at the checked commit
Other tools	The DNS lookup tools dig or nslookup for SPF, DKIM and DMARC checks. SKILL.md L75, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L75 at the checked commit
Other	Raw headers of the suspicious message in EML or MSG format. SKILL.md L73, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L73 at the checked commit
Account	Access to threat intelligence platforms for IP and domain reputation. SKILL.md L78, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L78 at the checked commit
Credentials	A VirusTotal API key, passed in the x-apikey header of the curl call. SKILL.md L233, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L233 at the checked commit
Credentials	An AbuseIPDB API key, passed in the Key header of the curl call. SKILL.md L197, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L197 at the checked commit
Other tools	The pyspf Python package for the SPF check. SKILL.md L182, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L182 at the checked commit
Other tools	The python-Levenshtein package for the lookalike-domain check. SKILL.md L218, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L218 at the checked commit

What the documented installer does

The recommended install runs npx skills add mukul975/Anthropic-Cybersecurity-Skills, naming the repository with no version, tag or commit. README.md L100-101, README.md#L100-101 at the checked commit
The alternative install clones the full repository's default branch with git clone. README.md L103-105, README.md#L103-105 at the checked commit
Step 1 of the workflow runs pip install pypff without a version pin when a PST file is processed. SKILL.md L93-94, skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L93-94 at the checked commit
The skill is part of a repository of 817 skills across 29 security domains, and the README tells users to clone that repository and point the agent at it. README.md L41, README.md#L41 at the checked commit

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Type: Skill · Defensive · works with Claude Code, Codex, Cursor, Gemini CLI, Copilot
Source: github.com/mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-email-headers-for-phishing-investigation · Apache-2.0 · manifest SKILL.md
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.: 101ca0b · v1.3.0 · last upstream push 2026-08-31 · no release since the pinned commit (current v1.3.0)
In the catalog: listed · added 2026-10-19 · last checked 2026-10-19 · next check 2027-01-17 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.: cisco-skill-scanner: not run, pending
Changes: none since the entry was added on 2026-10-19
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.: v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdown as JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit 101ca0b, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit 101ca0b on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (57 of 57), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Email Header Phishing Analysis". Agentic Security Field Guide, checked 2026-10-19, method reach-v0.1. https://readbeforerun.ai/catalog/mukul975-email-header-analysis/

The method · the rules

For maintainers

Badge for your README (reach 2 · not run yet):

[![reach 2 · not run yet](https://readbeforerun.ai/badge/mukul975-email-header-analysis.svg)](https://readbeforerun.ai/catalog/mukul975-email-header-analysis/)