email-security
starsforks
How to install email-security?
zhaoxuya520/reverse-skill/email-security
$npx -y skills add zhaoxuya520/reverse-skill --skill email-securityUse for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
SKILL.md
| 1 | # Email Security & Phishing Analysis |
| 2 | |
| 3 | ## ACTION REQUIRED（读完后立刻执行） |
| 4 | |
| 5 | 1. `NOW`: 确认授权（分析样本邮件 / 租户配置评审） |
| 6 | 2. `NOW`: 不向真实用户二次投递恶意样本 |
| 7 | 3. `ACT`: 头认证 → 内容/URL → 附件沙箱 → 租户控制面建议 |
| 8 | |
| 9 | ## 适用场景 |
| 10 | |
| 11 | - 钓鱼邮件拆解与 IOC |
| 12 | - SPF/DKIM/DMARC 配置评估 |
| 13 | - BEC 商务邮件欺诈模式 |
| 14 | - OAuth 应用钓鱼 / 邮箱令牌滥用（联合 llm/cloud 身份） |
| 15 | - 安全意识演练设计（授权） |
| 16 | |
| 17 | ## 工作流 |
| 18 | |
| 19 | ```text |
| 20 | □ 完整原始头：Received 链、From/Return-Path 一致性 |
| 21 | □ SPF/DKIM/DMARC 对齐结果 |
| 22 | □ URL 沙箱与附件静态（联合 malware-analysis） |
| 23 | □ 仿冒品牌与回复地址差异 |
| 24 | □ 租户：反钓鱼策略、外部标记、MFA、OAuth app 同意 |
| 25 | ``` |
| 26 | |
| 27 | ## 工具链 |
| 28 | |
| 29 | | 工具 | 用途 | |
| 30 | |------|------| |
| 31 | | 邮件客户端「查看源」 | 头 | |
| 32 | | dig/nslookup | SPF/DMARC 记录 | |
| 33 | | urlscan / 沙箱 | 链接与附件 | |
| 34 | | 租户管理中心 | 策略 | |
| 35 | |
| 36 | ## 参考 |
| 37 | |
| 38 | - `references/email-auth-checklist.md` |
| 39 | - `../malware-analysis/` `../attack-chain/`（钓鱼阶段） `../windows-ad/`（令牌） |
| 40 | |
| 41 | ## 路由上下文 |
| 42 | |
| 43 | **上游**: MASTER R36 |
| 44 | **MUST NOT**: 未授权对第三方域群发测试钓鱼 |
| 45 | |
| 46 | ## 任务完成自检 |
| 47 | |
| 48 | - [ ] 头认证结论是否完整？ |
| 49 | - [ ] IOC 是否可检测化（联合 threat-hunting）？ |
| 50 | - [ ] Checklist？ |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
