Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-phishing-email-headersgit clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-phishing-email-headers)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-phishing-email-headers"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-phishing-email-headers/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-phishing-email-headers"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-phishing-email-headers.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.00987 |
| Opus 5 | $0.00034 | $0.00494 |
| Sonnet 5 | $0.00013 | $0.00197 |
| Haiku 4.5 | $0.00007 | $0.00099 |
Grade A, and why
analyzing-phishing-email-headers scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
分析钓鱼电子邮件头
概述
电子邮件头包含关键元数据，能够揭示邮件的真实来源、路由路径和身份验证状态。分析这些头字段是识别钓鱼尝试、验证发件人真实性和收集威胁情报的基础技能。本技能涵盖使用手动技术和自动化工具对电子邮件头进行系统性提取和解读。
前置条件
- 基本了解 SMTP 协议和电子邮件投递原理
- 熟悉 DNS 记录（MX、TXT、SPF、DKIM、DMARC）
- 已安装 Python 3.8+
- 可访问能够导出原始头信息的邮件客户端（Outlook、Gmail、Thunderbird）
核心概念
关键头字段
- Received：邮件经过的邮件服务器链（从下到上阅读）
- From / Return-Path / Reply-To：发件人身份字段（常被伪造）
- Authentication-Results：SPF、DKIM、DMARC 验证结果
- X-Originating-IP：原始发件人 IP 地址
- Message-ID：唯一标识符；异常情况表明存在伪造
- X-Mailer / User-Agent：用于撰写邮件的客户端程序
头字段中的危险信号
From和Return-Path域名不匹配Authentication-Results中 SPF/DKIM/DMARC 验证失败Received链中出现陌生的中继服务器X-Originating-IP来自意外的地理位置- 缺失或格式异常的
Message-ID - 异常的
X-Mailer值（例如群发邮件工具）
实施步骤
步骤 1：提取原始邮件头
Gmail: 打开邮件 -> 三点菜单 -> "显示原始邮件"
Outlook: 打开邮件 -> 文件 -> 属性 -> Internet 头
Thunderbird: 查看 -> 邮件源代码（Ctrl+U）
步骤 2：使用 Python 解析头字段
使用 scripts/process.py 脚本自动完成头字段分析，包括 IP 地理定位、身份验证验证和异常检测。
步骤 3：验证身份验证链
- 检查 SPF 对齐：发送 IP 是否与域名的 SPF 记录匹配？
- 检查 DKIM 签名：密码学签名是否有效？
- 检查 DMARC 策略：邮件是否通过 DMARC 对齐检查？
步骤 4：追踪邮件路由
- 从下到上阅读
Received头字段 - 将每一跳的 IP 映射到组织/位置
- 识别意外的中继服务器或延迟
步骤 5：与威胁情报关联
- 在 AbuseIPDB、VirusTotal 上查询原始 IP
- 在 WHOIS 上查询发送域名的注册时间
- 搜索已知的钓鱼基础设施特征
工具与资源
- MXToolbox 头分析器: https://mxtoolbox.com/EmailHeaders.aspx
- Google Admin Toolbox: https://toolbox.googleapps.com/apps/messageheader/
- AbuseIPDB: https://www.abuseipdb.com/
- VirusTotal: https://www.virustotal.com/
- PhishTank: https://phishtank.org/
验证标准
- 成功解析来自 3 个不同邮件提供商的头字段
- 正确识别身份验证通过/失败状态
- 准确追踪电子邮件路由路径
- 在样本钓鱼邮件中检测出至少 3 个钓鱼指标
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 79 lines · 67 tokens per session scan A 341f0030cbc7
analyzing-phishing-email-headers is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (44 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 67 tokens to every session and 987 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-phishing-email-headers
Email headers contain critical metadata that reveals the true origin, routing path, and authentication status of emails. Analyzing these headers is a foundational skill for identifying phishing attemp.
analyzing-phishing-email-headers
Email headers contain critical metadata that reveals the true origin, routing path, and authentication status of emails. Analyzing these headers is a foundational skill for identifying phishing attemp.
analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.
analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.
analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.
analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.