{ "$schema": "https://readbeforerun.ai/schema/entry.schema.json", "entry": { "id": "mukul975-email-header-analysis", "name": "Email Header Phishing Analysis", "summary": "One skill from a large community collection: parses email headers to trace a phishing message and check SPF, DKIM and DMARC.", "draft": "review", "type": "skill", "mission": [ "defensive" ], "task": [ "email-phishing-analysis" ], "domain": [ "email-collaboration-security" ], "runtime": [ "claude-code", "codex", "cursor", "gemini-cli", "copilot" ], "tier": "listed", "last_checked": "2026-10-19", "next_check": "2027-01-17", "freshness": "fresh", "superseded": false, "in_my_kit": null, "advice": null, "code_shows": "writes outside the project · talks to any host · runs shell commands or eval · reads broad tokens or the environment · changes config or installs globally", "source": { "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills", "subpath": "skills/analyzing-email-headers-for-phishing-investigation", "commit": "101ca0bd887a295e39cc20a100efa571937ca969", "version": "v1.3.0", "license": "Apache-2.0" }, "install": { "skills_cli": null, "claude_code": null, "upstream": "npx skills add mukul975/Anthropic-Cybersecurity-Skills", "bundled": false }, "scan": { "status": "static scan pending (not run)" }, "reach": { "method": "reach-v0.1", "level": 2, "level_source": "static", "level_label": "open", "unknown_axes": 0, "verdict": "not-run", "badge": "reach 2 · not run yet", "long": "reach 2 from code (open); lab: not run yet", "declared": {}, "static": { "level": 2, "fs": 2, "net": 2, "exec": 2, "cred": 2, "persist": 2, "hitl": 0, "unknown": [] }, "observed": null, "surplus": null, "fit": null, "exports": { "aivss": { "fs": 0.5, "net": 0.5, "exec": 0.5, "cred": 0.5, "persist": 0.5, "hitl": 0 }, "usf_risk_tier": "L2" } }, "profile": { "read_at": "101ca0bd887a295e39cc20a100efa571937ca969", "read_on": "2026-10-25", "overview": "A skill that has the AI agent parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity and identify spoofing through SPF, DKIM and DMARC validation.", "purpose": [ "Verifies sender authenticity and identifies spoofing through SPF, DKIM and DMARC validation.", "Gives an AI agent the workflow a senior analyst follows: when to use a technique, what prerequisites to check, how to execute step by step and how to verify results." ], "use_cases": [ { "text": "Investigate a suspected phishing email to determine its true origin.", "task": "email-phishing-analysis" }, { "text": "Support incident response after a user has clicked a phishing link.", "task": "dfir" }, { "text": "Trace the delivery path and relay servers of a suspicious email.", "task": "email-phishing-analysis" }, { "text": "Validate SPF, DKIM and DMARC alignment to identify forged senders.", "task": "email-phishing-analysis" } ], "maturity": null, "capabilities": [ { "name": "Step 1: Extract Raw Email Headers", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "default" }, { "name": "Step 2: Parse the Email Header Chain", "effects": [ "reads", "runs-commands" ], "enabled": "default" }, { "name": "Step 3: Validate SPF, DKIM, and DMARC Records", "effects": [ "reads", "runs-commands" ], "enabled": "default" }, { "name": "Step 4: Analyze Sender Domain and Infrastructure", "effects": [ "reads", "runs-commands" ], "enabled": "default" }, { "name": "Step 5: Examine Email Body and Attachments", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "default" }, { "name": "Email Header Phishing Analysis Agent", "effects": [ "reads" ], "enabled": "optional" }, { "name": "API Reference: Email Header Analysis Tools", "effects": [ "reads", "sends-data" ], "enabled": "optional" }, { "name": "Output Format", "effects": [], "enabled": "default" }, { "name": "dns_lookup", "effects": [ "reads", "runs-commands" ], "enabled": "optional" } ], "effects": [ "reads", "changes", "runs-commands", "sends-data" ], "runs": "in-client", "listens": [], "sends_to": [ { "to": "Sender domain DNS", "kind": "target", "when": "default" }, { "to": "whois servers", "kind": "other", "when": "default" }, { "to": "AbuseIPDB", "kind": "vendor-api", "when": "default" }, { "to": "VirusTotal", "kind": "vendor-api", "when": "default" }, { "to": "VirusTotal URL Scan", "kind": "vendor-api", "when": "optional" }, { "to": "URLhaus or PhishTank", "kind": "vendor-api", "when": "optional" }, { "to": "PyPI", "kind": "download", "when": "optional" }, { "to": "VirusTotal", "kind": "vendor-api", "when": "optional" } ], "model": "client", "needs": [ { "kind": "runtime", "text": "Python with email parsing libraries." }, { "kind": "tools", "text": "The DNS lookup tools dig or nslookup for SPF, DKIM and DMARC checks." }, { "kind": "other", "text": "Raw headers of the suspicious message in EML or MSG format." }, { "kind": "account", "text": "Access to threat intelligence platforms for IP and domain reputation." }, { "kind": "credentials", "text": "A VirusTotal API key, passed in the x-apikey header of the curl call." }, { "kind": "credentials", "text": "An AbuseIPDB API key, passed in the Key header of the curl call." }, { "kind": "tools", "text": "The pyspf Python package for the SPF check." }, { "kind": "tools", "text": "The python-Levenshtein package for the lookalike-domain check." } ] }, "urls": { "page": "/catalog/mukul975-email-header-analysis/", "json": "/entries/mukul975-email-header-analysis.json", "md": "/catalog/mukul975-email-header-analysis.md", "badge": "/badge/mukul975-email-header-analysis.svg" } }, "data": { "schema_version": "0.5", "slug": "mukul975-email-header-analysis", "name": "Email Header Phishing Analysis", "summary": "One skill from a large community collection: parses email headers to trace a phishing message and check SPF, DKIM and DMARC.", "draft": "review", "in_my_kit": null, "type": "skill", "mission": [ "defensive" ], "task": [ "email-phishing-analysis" ], "domain": [ "email-collaboration-security" ], "phase": [ "def:detect" ], "role": [ "soc" ], "runtime": [ "claude-code", "codex", "cursor", "gemini-cli", "copilot" ], "auth": null, "autonomy": null, "addresses": [], "frameworks": { "owasp_ast": [], "owasp_asi": [], "attack_tactic": [], "atlas": [] }, "source": { "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills", "subpath": "skills/analyzing-email-headers-for-phishing-investigation", "commit": "101ca0bd887a295e39cc20a100efa571937ca969", "version": "v1.3.0", "license": "Apache-2.0", "manifest": "SKILL.md", "also_listed": {} }, "upstream": { "checked_at": "2026-10-19", "updated_at": "2026-08-31", "current_release": "v1.3.0", "archived": false, "stars": 34677, "commit_history": {}, "releases_since_pin": 0 }, "install": { "upstream": "npx skills add mukul975/Anthropic-Cybersecurity-Skills", "upstream_evidence": "README.md#L101", "bundled": false }, "scan": [ { "tool": "cisco-skill-scanner", "version": "not-run", "llm_judge": false, "date": "2026-10-19", "result": "pending" } ], "privileges": { "method": "reach-v0.1", "static": { "level": 2, "axes": { "fs": 2, "net": 2, "exec": 2, "cred": 2, "persist": 2, "hitl": 0 }, "evidence": { "fs": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L286 writes attachments to an absolute path outside the working directory, using a filename taken from the email", "net": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L232 sends the sender domain to the VirusTotal API and L196 the sending IP to AbuseIPDB", "exec": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L204 shell pipeline with a value taken from the email", "cred": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L233 VirusTotal API key header, a second user-supplied service key next to the AbuseIPDB key", "persist": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L94 runs pip install into the active Python environment with no virtual environment", "hitl": "none found: patterns hitl-v0.1 in 4 files at 101ca0b" }, "unknown": [] }, "min_config": { "status": "derived", "claude_code": "permissions.allow: [Read, Grep]; supply reputation API keys only if you use the optional VirusTotal and AbuseIPDB steps, quote header values before passing them to a shell, and save attachments under their hash instead of the file name given in the email", "note": "derived from the code, not tested in the lab" }, "override": null, "reviews": [] }, "status": { "tier": "listed", "last_checked": "2026-10-19", "next_check": "2027-01-17", "freshness": "fresh", "superseded": false, "superseded_by": null, "added": "2026-10-19", "added_by": "scout" }, "evidence": { "runs": [], "badge": "/badge/mukul975-email-header-analysis.svg" }, "changes": [] }, "profile": { "schema_version": "0.1", "entry": "mukul975-email-header-analysis", "draft": "review", "commit": "101ca0bd887a295e39cc20a100efa571937ca969", "read_on": "2026-10-25", "check": { "date": "2026-10-25", "facts": 57, "confirmed": 57, "verified": 51 }, "overview": { "text": "A skill that has the AI agent parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity and identify spoofing through SPF, DKIM and DMARC validation.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L3-4 frontmatter description" }, "purpose": [ { "text": "Verifies sender authenticity and identifies spoofing through SPF, DKIM and DMARC validation.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L4 frontmatter description, second line" }, { "text": "Gives an AI agent the workflow a senior analyst follows: when to use a technique, what prerequisites to check, how to execute step by step and how to verify results.", "ev": "README.md#L142 author's stated reason for the collection" } ], "use_cases": [ { "text": "Investigate a suspected phishing email to determine its true origin.", "task": "email-phishing-analysis", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L66 When to Use" }, { "text": "Support incident response after a user has clicked a phishing link.", "task": "dfir", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L68 When to Use" }, { "text": "Trace the delivery path and relay servers of a suspicious email.", "task": "email-phishing-analysis", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L69 When to Use" }, { "text": "Validate SPF, DKIM and DMARC alignment to identify forged senders.", "task": "email-phishing-analysis", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L70 When to Use" } ], "not_for": [], "capabilities": { "coverage": "complete", "groups": [ { "name": "Step 1: Extract Raw Email Headers", "does": "Names where Outlook, Gmail and Thunderbird show raw headers and copies an EML file from a mounted forensic image into /cases/case-2024-001/email/.", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "default", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L82-91 Step 1 heading and cp into /cases" }, { "name": "Step 2: Parse the Email Header Chain", "does": "Prints From, To, Subject, Return-Path, X-Originating-IP and similar fields, the Received hops bottom-up, Authentication-Results, ARC, Received-SPF and DKIM-Signature.", "effects": [ "reads", "runs-commands" ], "enabled": "default", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L118 Step 2 heading" }, { "name": "Step 3: Validate SPF, DKIM, and DMARC Records", "does": "Runs dig TXT lookups for SPF, the DKIM selector and _dmarc, an SPF check of the sending IP with pyspf spf.check2, and an AbuseIPDB reputation query.", "effects": [ "reads", "runs-commands" ], "enabled": "default", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L158 Step 3 heading" }, { "name": "Step 4: Analyze Sender Domain and Infrastructure", "does": "Runs whois, dig A/MX/NS and reverse DNS, a Levenshtein lookalike-domain check, a VirusTotal domain lookup and a From versus Reply-To comparison.", "effects": [ "reads", "runs-commands" ], "enabled": "default", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L200 Step 4 heading" }, { "name": "Step 5: Examine Email Body and Attachments", "does": "Extracts URLs from the body, flags links whose display text differs from the href, hashes attachments with SHA-256 and saves them to the case folder.", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "default", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L249 Step 5 heading" }, { "name": "Email Header Phishing Analysis Agent", "does": "Parses the EML file given as argument and prints From, To, Subject, Date, hop IPs, SPF/DKIM/DMARC verdicts, a URL count, href mismatches, attachment hashes and indicators.", "effects": [ "reads" ], "enabled": "optional", "ev": "skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L187-196 __main__ banner and EML argument" }, { "name": "API Reference: Email Header Analysis Tools", "does": "Reference for the email module, dig, pyspf, dkimpy dkim.verify, AbuseIPDB, VirusTotal domain lookup, VirusTotal URL Scan POST and whois.", "effects": [ "reads", "sends-data" ], "enabled": "optional", "ev": "skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L103-107 URL Scan submits a URL to VirusTotal" }, { "name": "Output Format", "does": "Report template with headers, delivery path hops, SPF/DKIM/DMARC results, phishing indicators and a risk level.", "effects": [], "enabled": "default", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L334-337 Output Format section" }, { "name": "dns_lookup", "does": "The agent.py helper dns_lookup runs dig +short through subprocess.run with a 10-second timeout.", "effects": [ "reads", "runs-commands" ], "enabled": "optional", "ev": "skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L147-153 dig run through subprocess" } ] }, "architecture": { "summary": { "text": "SKILL.md holds frontmatter and a five-step Workflow that the client's model executes step by step with bash, dig, whois, curl and inline python3 on the user's machine; Steps 3 and 4 curl AbuseIPDB and VirusTotal; scripts/agent.py parses EML files locally.", "ev": "README.md#L197 agent executes the Workflow section step by step" }, "runs": { "where": "in-client", "text": "Loads into Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI and other agentskills.io clients, whose model follows it.", "ev": "README.md#L108 skills load into AI coding clients" }, "modes": [ { "where": "local-program", "mode": "standalone script", "switch": "python agent.py ", "text": "The bundled scripts/agent.py runs as a standalone Python command against one EML file.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L228 usage line" } ], "parts": [ { "name": "SKILL.md", "zone": "client", "does": "Skill definition with frontmatter, When to Use, Prerequisites, a five-step Workflow and an Output Format.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L2 skill name" }, { "name": "references/api-reference.md", "zone": "client", "does": "Reference file with commands and API calls for email parsing, DNS, SPF, DKIM, AbuseIPDB, VirusTotal and whois.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L1 title" }, { "name": "scripts/agent.py", "zone": "machine", "does": "Python script that parses an EML file and prints header, authentication, URL, attachment and indicator results.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L2 module docstring" }, { "name": "/cases/case-2024-001/email", "zone": "machine", "does": "Case folder holding the EML or PST evidence, extracted header files and saved attachments.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L126 workflow reads the EML from the case folder" }, { "name": "DNS and whois servers", "zone": "outside", "does": "DNS and whois services queried for SPF, DKIM, DMARC, A, MX, NS, reverse DNS and registration data of the sender.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L173 DMARC lookup" }, { "name": "AbuseIPDB and VirusTotal", "zone": "outside", "does": "Reputation services queried for the sending IP and sender domain with user-supplied API keys.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L194-197 reputation query step" }, { "name": "/mnt/evidence forensic image", "zone": "machine", "does": "Mounted forensic image from which Step 1 copies the suspect's Outlook EML file into the case folder.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L89-91 cp from /mnt/evidence" } ], "listens": [], "connections": [ { "to": "Sender domain DNS", "kind": "target", "when": "default", "what": "dig queries the sender domain's TXT records (SPF, DKIM selector, _dmarc), its A, MX and NS records, and reverse DNS of the sending IP.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L165 SPF lookup" }, { "to": "whois servers", "kind": "other", "when": "default", "what": "whois fetches registrar, creation, expiration, registrant and nameserver data for the sender domain.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L204 whois lookup" }, { "to": "AbuseIPDB", "kind": "vendor-api", "when": "default", "what": "Sends the sending IP to the AbuseIPDB check endpoint with the user's API key.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L196 AbuseIPDB curl" }, { "to": "VirusTotal", "kind": "vendor-api", "when": "default", "what": "Sends the sender domain to the VirusTotal domains endpoint with the user's API key.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L232 VirusTotal domain curl" }, { "to": "VirusTotal URL Scan", "kind": "vendor-api", "when": "optional", "what": "The API reference documents a POST that submits a URL to VirusTotal for scanning.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md#L103-107 URL Scan" }, { "to": "URLhaus or PhishTank", "kind": "vendor-api", "when": "optional", "what": "Step 5 comments direct submitting URLs found in the body to URLhaus or PhishTank for a reputation check.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L291 Step 5 comment" }, { "to": "PyPI", "kind": "download", "when": "optional", "what": "Downloads the pypff package with pip when a PST file has to be processed.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L93-94 pip install pypff in the PST branch" }, { "to": "VirusTotal", "kind": "vendor-api", "when": "optional", "what": "A Step 5 comment directs submitting attachment hashes to VirusTotal.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L290 Step 5 comment" } ], "model": { "who": "client", "text": "The AI client's model scans the skill frontmatter and loads the full workflow when the skill matches the task.", "ev": "README.md#L182 progressive loading by the agent" } }, "needs": [ { "kind": "runtime", "text": "Python with email parsing libraries.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L77 prerequisite" }, { "kind": "tools", "text": "The DNS lookup tools dig or nslookup for SPF, DKIM and DMARC checks.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L75 prerequisite" }, { "kind": "other", "text": "Raw headers of the suspicious message in EML or MSG format.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L73 prerequisite" }, { "kind": "account", "text": "Access to threat intelligence platforms for IP and domain reputation.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L78 prerequisite" }, { "kind": "credentials", "text": "A VirusTotal API key, passed in the x-apikey header of the curl call.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L233 VirusTotal key placeholder" }, { "kind": "credentials", "text": "An AbuseIPDB API key, passed in the Key header of the curl call.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L197 AbuseIPDB key placeholder" }, { "kind": "tools", "text": "The pyspf Python package for the SPF check.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L182 install hint" }, { "kind": "tools", "text": "The python-Levenshtein package for the lookalike-domain check.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L218 install hint" } ], "installer": [ { "text": "The recommended install runs npx skills add mukul975/Anthropic-Cybersecurity-Skills, naming the repository with no version, tag or commit.", "ev": "README.md#L100-101 Quick start option 1" }, { "text": "The alternative install clones the full repository's default branch with git clone.", "ev": "README.md#L103-105 Quick start option 2" }, { "text": "Step 1 of the workflow runs pip install pypff without a version pin when a PST file is processed.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L93-94 runtime pip install" }, { "text": "The skill is part of a repository of 817 skills across 29 security domains, and the README tells users to clone that repository and point the agent at it.", "ev": "README.md#L41 README states the collection size and the clone-and-point usage for the whole repository" } ], "limits": [ { "text": "Step 5 writes each attachment under /cases/case-2024-001/email/attachments/ using the filename from the message's MIME part (part.get_filename()) as the path component.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L279-286 filename from the email used in the write path" }, { "text": "When extract_attachments in scripts/agent.py gets an output_dir, it joins it with the attachment filename from the message via os.path.join before writing.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L137-141 save path built from message filename" }, { "text": "Step 3 sets SENDER_DOMAIN for the envelope sender domain and expands it unquoted in shell lines such as dig TXT $SENDER_DOMAIN +short.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L161-165 header value used unquoted in shell" }, { "text": "scripts/agent.py takes SPF, DKIM and DMARC verdicts from the message's existing Authentication-Results headers.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L47-49 source of authentication verdicts" }, { "text": "scripts/agent.py reads its input as a text EML file with email.message_from_file.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py#L14-17 input parsing" }, { "text": "Scenario 4 describes phishing sent through a legitimate email marketing service where SPF and DKIM pass, which requires URL and content analysis rather than header authentication checks.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L332 Scenario 4" }, { "text": "The Key Concepts table states that attackers can forge From, Reply-To and other headers but not Received chains.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L305 Key Concepts row" }, { "text": "The README describes the repository as an independent community project not affiliated with Anthropic PBC.", "ev": "README.md#L35 affiliation notice" }, { "text": "Step 1 writes the transport headers of each PST message to /cases/case-2024-001/email/ under a filename that includes the first 30 characters of the message subject.", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L104-110 subject from the message used in the write path" }, { "text": "The Step 3 pyspf check calls spf.check2 with fixed example values for IP, sender and HELO name (203.0.113.45, sender@example-corp.com, mail.example-corp.com).", "ev": "skills/analyzing-email-headers-for-phishing-investigation/SKILL.md#L184-188 hard-coded spf.check2 arguments" } ], "not_found": [ { "field": "maturity", "searched": "SKILL.md frontmatter (version '1.0'), README.md, .claude-plugin/plugin.json, .claude-plugin/marketplace.json for preview/experimental/alpha/beta/stable/deprecated" }, { "field": "not_for", "searched": "SKILL.md, README.md, SECURITY.md for out-of-scope, authorised-use-only or do-not-use statements" }, { "field": "capability_count", "searched": "SKILL.md, README.md, plugin.json; the 817 skills figure counts the whole collection, not this skill" }, { "field": "listen", "searched": "scripts/agent.py, SKILL.md, references/api-reference.md for socket, bind, host, port, server" } ] }, "verdict": null, "runs": [] }