Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add GoldenWing-360/claude-security-skills --skill email-deliverability-securitygit clone --depth 1 https://github.com/GoldenWing-360/claude-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/goldenwing-360/claude-security-skills/email-deliverability-security)<a href="https://agentmods.dev/skills/goldenwing-360/claude-security-skills/email-deliverability-security"><img src="https://agentmods.dev/badge/skills/goldenwing-360/claude-security-skills/email-deliverability-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/goldenwing-360/claude-security-skills/email-deliverability-security"><img src="https://agentmods.dev/badge/skills/goldenwing-360/claude-security-skills/email-deliverability-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.03000 |
| Opus 5 | $0.00043 | $0.01500 |
| Sonnet 5 | $0.00017 | $0.00600 |
| Haiku 4.5 | $0.00009 | $0.00300 |
Grade A, and why
email-deliverability-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 245 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Email Authentication & Deliverability Security
Email security has two faces — inbound (don't get phished) and outbound (don't get spoofed, don't land in spam). This skill is about the outbound posture: configuring SPF, DKIM, DMARC, and friends so your real mail authenticates and impostors are rejected.
Done right, this is a one-evening project per domain that pays off forever. Done wrong, your password reset emails land in junk and attackers send invoices to your customers from [email protected].
When to invoke
- Launching a new sending domain
- Your domain is being spoofed (you see bounce reports for mail you didn't send)
- Transactional mail (password reset, receipts) consistently lands in spam
- Consolidating from multiple ESPs to one
- An auditor asks about your DMARC posture
- After a phishing wave that abused your domain
The pieces — what each record does
| Record | Purpose | Required? |
|---|---|---|
| SPF | Lists which servers are allowed to send for the domain | Yes |
| DKIM | Signs each message with a key in DNS; receiver verifies signature | Yes |
| DMARC | Tells receivers what to do when SPF or DKIM fails, and where to send reports | Yes |
| MTA-STS | Forces TLS between sending and receiving MTAs | Recommended |
| TLS-RPT | Receives reports of TLS failures | Recommended |
| BIMI | Shows your brand logo in supporting mail clients | Optional, requires DMARC enforcement + VMC |
| ARC | Preserves auth state when mail passes through forwarders (mailing lists) | Receiver-side mostly, set up if you forward |
A "fully authenticated" sending posture needs at least SPF + DKIM + DMARC with a real policy.
Step 1 — SPF
SPF lists every IP / hostname / third-party allowed to send from your domain.
v=spf1 mx include:_spf.google.com include:mailgun.org include:sendgrid.net -all
Key rules:
-all(hard fail) is the goal.~all(soft fail) is acceptable as a stepping stone but eventually move to-all.- 10 DNS lookup limit. Every
include:andaandmxmechanism counts. Many ESPs publish records that chain dozens ofinclude:and silently push you over the limit. Use dmarcian's SPF surveyor to count. - Flatten if needed: services like mxtoolbox, spfwizard, or your own automation can resolve the chain to IPs once and produce a flat record. Refresh periodically — the providers change theirs.
- One SPF record per domain. Multiple TXT records starting with
v=spf1is a permanent fail.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 245 lines · 85 tokens per session scan A 0bfecdbdd051
email-deliverability-security is a skill published in the GitHub repository GoldenWing-360/claude-security-skills (17 stars, last pushed 1mo ago), licensed MIT. It adds 85 tokens to every session and 3,000 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ux-audit
Walk through a live web app AS a real user to find usability + behavioural bugs that static reviews miss. REQUIRES proof of interaction (typing, clicking, sending, observing) before any verdict — a sweep that didn't interact terminates with verdict 'Incomplete'. Walks threads, exercises every element, runs the…
design-loop
Autonomous multi-page site builder using a baton-passing loop. Each iteration reads a task from .design/next-prompt.md, generates a page in HTML/Tailwind, integrates it into the site, verifies visually, then writes the next task to keep the loop alive. Use whenever the user asks to build an entire site autonomously…
product-showcase
Generate a comprehensive marketing website for a web app — multi-page with real screenshots, animated GIF walkthroughs, feature deep-dives, and workflow demonstrations. Browses the running app, captures screens and sequences, and produces a deployable site that actually teaches people what the product does. Especially…
tanstack-start
Build a full-stack TanStack Start app on Cloudflare Workers from scratch — SSR, file-based routing, server functions, D1+Drizzle, better-auth, Tailwind v4+shadcn/ui. Use whenever the user mentions TanStack Start, asks to scaffold a full-stack Cloudflare app with SSR, wants an SSR dashboard, or asks for a React 19 +…
color-palette
Generate complete, accessible colour palettes from a single brand hex. Produces 11-shade scale (50-950), semantic tokens, dark mode variants, Tailwind v4 CSS output, WCAG contrast checks. Use whenever the user supplies a brand hex and asks for a palette, mentions setting up a design system, wants Tailwind theme…
deep-research
Deep research and discovery before building something new. Explores local projects for reusable code, researches competitors, reads forums and reviews, analyses plugin ecosystems, investigates technical options, and produces a comprehensive research brief. Three depths: focused (30 min), wide (1-2 hours), deep (3-6…