analyzing-email-headers-for-phishing-investigation

Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying whether a message's sender domain was spoofed.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-email-headers-for-phishing-investigation/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A code-rich, actionable workflow with clear sequencing, weakened by unreferenced bundle files, a concepts table that restates known material, and minor redundancy. Linking the existing api-reference.md and agent.py would materially improve organization.

Suggestions

Reference the bundle files from the body: add a pointer to references/api-reference.md for full API syntax and to scripts/agent.py (a ready-to-run analyzer) so the SKILL.md body can trim inlined code and act as an overview.

Remove or compress the Key Concepts table entries that restate well-known definitions (SPF/DKIM/DMARC), keeping only operationally non-obvious notes such as reading Received headers bottom-to-top.

De-duplicate the From/Reply-To mismatch logic (present in both Step 4 and Step 5) and add an explicit feedback loop in Step 3 (e.g., 'if SPF/DKIM/DMARC fails or is misaligned, treat sender as unauthenticated and proceed to content/URL analysis').

Dimension	Reasoning	Score
Conciseness	The bulk is lean executable code, but the Key Concepts table re-explains SPF/DKIM/DMARC and basic header semantics Claude already knows, and the From/Reply-To mismatch check is redundantly implemented in both Step 4 and Step 5 — so it is mostly efficient with some unnecessary material.	3 / 5
Actionability	Provides concrete, mostly executable code (Python email parsing, dig, pyspf, whois, Levenshtein, curl reputation lookups) covering common cases, but DKIM signature verification code is absent from the workflow (only listed in the tools table) and example values are hardcoded.	4 / 5
Workflow Clarity	Five steps are clearly sequenced (extract → parse → validate auth → analyze domain → examine body) with SPF/DKIM/DMARC and mismatch checks as checkpoints, though explicit 'if-fail-then-fix' feedback loops are missing, keeping it just below anchor 5.	4 / 5
Progressive Disclosure	The body has good section structure but never references or signals the provided bundle files (references/api-reference.md, scripts/agent.py), and API-reference-style code is inlined rather than split out — matching 'references present but not clearly signaled; content that should be separate is inline.'	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both capability and trigger conditions with concrete, natural-language phrases. The only minor gap is the absence of file-extension triggers (.eml/.msg).

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Parse and analyze email headers (Received chain, Return-Path, Message-ID)', 'trace the true origin', 'validate SPF, DKIM, and DMARC results', 'confirm or rule out sender spoofing' — with comprehensive coverage matching the anchor-5 example.	5 / 5
Completeness	Explicitly answers both 'what' ('Parse and analyze email headers... validate SPF, DKIM, and DMARC') and 'when' ('Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying...') with concrete trigger phrases, matching the anchor-5 example.	5 / 5
Trigger Term Quality	Includes natural phrases users would say ('phishing email', 'phishing incident', 'suspicious or reported email', 'sender domain was spoofed') but omits file-extension triggers like .eml/.msg that a user might mention, so it sits just below comprehensive coverage.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (email header phishing analysis with SPF/DKIM/DMARC validation) with distinct, specific triggers and minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-email-headers-for-phishing-investigation/SKILL.md
Commit: 54a7988

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.