Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
1.0.1: Add fast-drop rules + clarify subject+sender triage before SPF/DKIM/DMARC; content analysis only after technical pass.
What This Skill Does
Judges email importance and urgency by analyzing subject lines, technical headers (SPF/DKIM/DMARC), and message content rather than trusting sender display names or mailbox labels. Uses a three-stage workflow: cheap title triage first, then technical verification only when warranted, then content analysis. Treats sender identity as a weak, spoofable signal throughout.
Sender-based filters can be bypassed by spoofed display names and lookalike domains; analyzing headers, link targets, and requested actions catches phishing that passes conventional spam checks.
When to use it
- Deciding if a bank security alert is a phishing attempt
- Triaging an inbox after receiving a suspicious invoice email
- Evaluating whether a package delivery failure notice is legitimate
- Checking if an IT department password reset request is genuine
- Assessing an urgent payment demand from an unrecognized sender
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Is this email from 'PayPal Security <security@paypa1-verify.com>' telling me to click a link and reset my password real?
- 1Check subject line and sender address for fast-drop signals
- 2Identify typo-squatting: 'paypa1-verify.com' substitutes digit '1' for the letter 'l'
- 3Apply fast-drop rule: official brand name paired with a suspicious unrelated domain
- 4Classify the requested action as account/authentication with urgency pressure
- 5Recommend navigating directly to paypal.com instead of clicking any link
Risk: High (likely phishing). Importance: Low. Do not click any links. Open paypal.com directly in your browser to check account status.