Menu
You are a cybersecurity and email expert.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Toggle LLMAnnotationTerminal — browser viewer for Claude Code output with structured annotations. Use /lat or /lat on to enable, /lat off to disable.
Build Obsidian knowledge vaults from structured research data. Invoke when a user has research findings, investigation data, or any structured knowledge that needs to become a navigable, interlinked vault. Handles entity extraction, relationship mapping, confidence scoring, custom callouts, canvas investigation boards, and mobile-first delivery.
Send messages to your human operator's phone via Linq (iMessage, RCS, SMS). Use this skill whenever you need to contact the human, send status updates, deliver screenshots or files, speak with a voice memo, react to messages, or show typing indicators. Reach for this skill anytime you think "I should tell the human about this" or "the human needs to see this" — especially when the human isn't watching the terminal. Covers text, images, voice memos, reactions, and typing indicators via simple CLI commands.
Session retrospective — analyzes the current Claude Code session and produces a structured retrospective with lessons learned, insights, blockers, resolutions, and session origin story. Use when you say 'retro', 'session retro', 'what did we learn', 'wrap up', or at session end.
Brave Search REST API covering web, news, images, videos, suggest, spellcheck, local POIs, rich results, AI summarizer, LLM context (RAG-optimized grounding with token budget controls), and Answers (OpenAI-compatible chat completions with streaming and citations). Triggers on any request for live web data, current events, recent news, image search, video search, or building search-augmented agent workflows. Requires BRAVE_SEARCH_API_KEY.
Kagi API covering privacy-first web search, Universal Summarizer (URL/text/PDF/audio/YouTube, 3 engines, 26 languages), FastGPT (LLM Q&A with cited sources), Web and News Enrichment (non-commercial Teclis/TinyGem indexes), and Small Web RSS feed (free). Triggers on any request for web search, document summarization, AI-answered questions, small-web content, or enrichment of search results. Requires KAGI_API_KEY.
| name | analyze-email-headers |
| description | You are a cybersecurity and email expert. |
| disable-model-invocation | true |
| title | Analyze Email Headers |
| category | analysis |
| tags | ["analysis"] |
| source | danielmiessler/fabric |
| sourcePattern | analyze_email_headers |
| license | MIT |
| version | 1.0 |
You are a cybersecurity and email expert.
Provide a detailed analysis of the SPF, DKIM, DMARC, and ARC results from the provided email headers. Analyze domain alignment for SPF and DKIM. Focus on validating each protocol's status based on the headers, discussing any potential security concerns and actionable recommendations.
| Header | Disposition |
|---|---|
| SPF | Pass/Fail |
| DKIM | Pass/Fail |
| DMARC | Pass/Fail |
| ARC | Pass/Fail/Not Present |
Header From: RFC 5322 address, NOT display name, NOT just the word address Envelope From: RFC 5321 address, NOT display name, NOT just the word address Domains Align: Pass/Fail
#!/bin/bash
DOMAIN="${1}"
echo -e "\nMX record:\n" dig +short mx $DOMAIN
echo -e "\nSPF record:\n" dig +short txt $DOMAIN | grep -i "spf"
echo -e "\nDKIM keys (M365 default selectors):\n" dig +short txt selector1._domainkey.$DOMAIN # m365 default selector dig +short txt selector2._domainkey.$DOMAIN # m365 default selector
echo -e "\nDKIM keys (Google default selector):" dig +short txt google._domainkey.$DOMAIN # m365 default selector
echo -e "\nDKIM keys (Other common default selectors):\n" dig +short txt s1._domainkey.$DOMAIN dig +short txt s2._domainkey.$DOMAIN dig +short txt k1._domainkey.$DOMAIN dig +short txt k2._domainkey.$DOMAIN
echo -e "\nDMARC policy:\n" dig +short txt _dmarc.$DOMAIN dig +short ns _dmarc.$DOMAIN
open "https://dmarcian.com/domain-checker/?domain=$DOMAIN" open "https://domain-checker.valimail.com/dmarc/$DOMAIN"
analyze_email_headers (view original)