Agent skill

Detecting Spearphishing With Email Gateway

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting…

Apache-2.0Auto-check passedSecurity

Install Detecting Spearphishing With Email Gateway

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-spearphishing-with-email-gateway --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/detecting-spearphishing-with-email-gateway .claude/skills/detecting-spearphishing-with-email-gateway && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "detecting-spearphishing-with-email-gateway" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/detecting-spearphishing-with-email-gateway into .claude/skills/detecting-spearphishing-with-email-gateway/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "detecting-spearphishing-with-email-gateway", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/detecting-spearphishing-with-email-gateway

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-spearphishing-with-email-gateway --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/detecting-spearphishing-with-email-gateway .agents/skills/detecting-spearphishing-with-email-gateway && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "detecting-spearphishing-with-email-gateway" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/detecting-spearphishing-with-email-gateway into .agents/skills/detecting-spearphishing-with-email-gateway/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "detecting-spearphishing-with-email-gateway", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-spearphishing-with-email-gateway --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/detecting-spearphishing-with-email-gateway .cursor/skills/detecting-spearphishing-with-email-gateway && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "detecting-spearphishing-with-email-gateway" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/detecting-spearphishing-with-email-gateway into .cursor/skills/detecting-spearphishing-with-email-gateway/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "detecting-spearphishing-with-email-gateway", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-spearphishing-with-email-gateway

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-spearphishing-with-email-gateway --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/detecting-spearphishing-with-email-gateway .gemini/skills/detecting-spearphishing-with-email-gateway && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "detecting-spearphishing-with-email-gateway" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/detecting-spearphishing-with-email-gateway into .gemini/skills/detecting-spearphishing-with-email-gateway/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "detecting-spearphishing-with-email-gateway", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-spearphishing-with-email-gateway

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/detecting-spearphishing-with-email-gateway .github/skills/detecting-spearphishing-with-email-gateway && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "detecting-spearphishing-with-email-gateway" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/detecting-spearphishing-with-email-gateway into .github/skills/detecting-spearphishing-with-email-gateway/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "detecting-spearphishing-with-email-gateway", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-spearphishing-with-email-gateway --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/detecting-spearphishing-with-email-gateway .opencode/skills/detecting-spearphishing-with-email-gateway && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "detecting-spearphishing-with-email-gateway" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/detecting-spearphishing-with-email-gateway into .opencode/skills/detecting-spearphishing-with-email-gateway/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "detecting-spearphishing-with-email-gateway", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: detecting-spearphishing-with-email-gateway
GitHub stars: 34k
Token cost: ~1.4k tokens
SKILL.md length: 402 words
Files: 8 (incl. scripts, references, assets)
Skills in repo: 644
Repo updated: Aug 31, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting…

Works in 5 steps: Configure Impersonation Protection → Configure URL Protection → Configure Attachment Sandboxing → …
Hardening a mail gateway against targeted phishing
SKILL.md covers Overview, When to Use, Prerequisites and Key Concepts, plus 3 more sections
Runs Python scripts from its folder

What it does

Detecting Spearphishing With Email Gateway is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint, Mimecast, or Barracuda. Use when hardening a mail gateway against targeted phishing or investigating a suspected spearphishing campaign.

Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering Cloud office suites. It works with Microsoft Defender and Microsoft 365. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

Hardening a mail gateway against targeted phishing
Investigating a suspected spearphishing campaign

Example prompts

“/detecting-spearphishing-with-email-gateway”

Requirements

Python 3

Workflow steps

5 steps, taken from the step headings in SKILL.md.

Configure Impersonation Protection
Configure URL Protection
Configure Attachment Sandboxing
Create Custom Detection Rules
Configure Alert and Response Actions

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 2 files in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
- security.microsoft.com
- proofpoint.com
- mimecast.com
- barracuda.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Detecting Spearphishing With Email Gateway loads about 1.4k tokens when it runs, and up to ~3.5k if it reads all its reference files. Until then it costs about 119 tokens; SKILL.md has 402 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~119
When it runs · the whole SKILL.md, loaded when a task matches: ~1.4k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~3.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 402 words, ~1,388 tokens.

Download SKILL.mdSave it as .claude/skills/detecting-spearphishing-with-email-gateway/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.

name: detecting-spearphishing-with-email-gateway
description: Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint, Mimecast, or Barracuda. Use when hardening a mail gateway against targeted phishing or investigating a suspected spearphishing campaign.
domain: cybersecurity
subdomain: phishing-defense
tags: phishing, email-security, social-engineering, dmarc, awareness, spearphishing, email-gateway
version: 1.0
author: mahipal
license: Apache-2.0
nist_csf: PR.AT-01, DE.CM-09, RS.CO-02, DE.AE-02
mitre_attack: T1566.001, T1566.002, T1204.001, T1204.002
mitre_f3.version: 1.1
mitre_f3.tactics: reconnaissance, initial-access, stealth, resource-development

Detecting Spearphishing with Email Gateway

Overview

Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint, Mimecast, and Barracuda provide advanced detection capabilities including behavioral analysis, URL detonation, attachment sandboxing, and impersonation detection. This skill covers configuring these gateways to detect and block targeted phishing attacks.

When to Use

When investigating security incidents that require detecting spearphishing with email gateway
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Access to email security gateway admin console
Understanding of email flow architecture (MX records, transport rules)
Familiarity with SPF/DKIM/DMARC authentication
Knowledge of common spearphishing techniques and pretexts

Key Concepts

Spearphishing Characteristics

Targeted recipients: Specific individuals, often executives or finance staff
Researched pretexts: References to real projects, colleagues, or events
Impersonation: Spoofs trusted senders (CEO, vendor, partner)
Low volume: Few emails to avoid pattern-based detection
Urgent tone: Creates pressure to act quickly

Gateway Detection Layers

Reputation filtering: IP/domain/URL reputation scoring
Authentication checks: SPF, DKIM, DMARC validation
Content analysis: NLP-based analysis of email body
Impersonation detection: Display name and domain similarity matching
URL analysis: Real-time URL detonation and redirect following
Attachment sandboxing: Behavioral analysis of attachments in isolated environments
Behavioral analytics: Anomaly detection in communication patterns

Workflow

Step 1: Configure Impersonation Protection

Microsoft Defender for Office 365:
  Security > Anti-phishing policies > Impersonation settings
  - Enable user impersonation protection for VIPs
  - Enable domain impersonation protection
  - Add protected users (CEO, CFO, HR Director)
  - Set action: Quarantine message

Proofpoint:
  Email Protection > Impostor Classifier
  - Enable display name spoofing detection
  - Configure lookalike domain detection
  - Set Impostor threshold sensitivity

Show full SKILL.md (160 more words)Show less

Step 2: Configure URL Protection

Enable Safe Links / URL rewriting
Enable time-of-click URL detonation
Block newly registered domains (< 30 days)
Enable URL redirect chain following

Step 3: Configure Attachment Sandboxing

Enable Safe Attachments / attachment sandboxing
Configure dynamic delivery (deliver body, hold attachments)
Set sandbox detonation timeout to 60+ seconds
Block macro-enabled Office documents from external senders

Step 4: Create Custom Detection Rules

Use the scripts/process.py to analyze email gateway logs, identify spearphishing patterns, and generate custom detection rules.

Step 5: Configure Alert and Response Actions

Real-time alerts for impersonation attempts
Automatic quarantine for high-confidence detections
User notification with safety tips
Integration with SIEM for correlation

Tools & Resources

Microsoft Defender for Office 365: https://security.microsoft.com
Proofpoint Email Protection: https://www.proofpoint.com/us/products/email-security
Mimecast Email Security: https://www.mimecast.com/products/email-security/
Barracuda Email Protection: https://www.barracuda.com/products/email-protection

Validation

Impersonation protection correctly identifies spoofed VIP display names
URL detonation catches malicious links in test phishing emails
Attachment sandboxing detects weaponized documents
Custom rules trigger on known spearphishing patterns
SIEM integration receives gateway alerts

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/detecting-spearphishing-with-email-gateway of mukul975/Anthropic-Cybersecurity-Skills.

SKILL.md
LICENSE
assets/template.md
references/api-reference.md
references/standards.md
references/workflows.md
scripts/agent.py
scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Detecting Spearphishing With Email Gateway next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Detecting Spearphishing With Email Gateway compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Detecting Spearphishing With Email Gateway this skillmukul975/Anthropic-Cybersecurity-Skills	34k	—	~1.4k	Automated safety check: Pass	Apache-2.0	1 mo ago
Cloud App Security Posturevinayaklatthe/microsoft-security-skills	175	—	~2.1k	Automated safety check: Pass	MIT	3 mo ago
Sentinelvinayaklatthe/microsoft-security-skills	175	—	~2.2k	Automated safety check: Pass	MIT	3 mo ago
Defender Xdrvinayaklatthe/microsoft-security-skills	175	—	~2.1k	Automated safety check: Pass	MIT	3 mo ago
Copilot For M365 Readinessvinayaklatthe/microsoft-security-skills	175	—	~2.1k	Automated safety check: Pass	MIT	3 mo ago
Defender For Office 365vinayaklatthe/microsoft-security-skills	175	—	~2.6k	Automated safety check: Pass	MIT	3 mo ago

Similar skills

Cloud App Security Posture
vinayaklatthe/microsoft-security-skills
Guidance for cloud and SaaS security posture management - combining Defender for Cloud CSPM (IaaS/PaaS) and Defender for Cloud Apps SSPM (SaaS) to assess and harden posture across cloud and SaaS apps.
175 GitHub stars~2.1k tokensUpdated 3 mo ago
SecurityAuto-check passed
Sentinel
vinayaklatthe/microsoft-security-skills
Guidance for designing and operating Microsoft Sentinel, the cloud-native SIEM and SOAR delivered through the Defender portal.
175 GitHub stars~2.2k tokensUpdated 3 mo ago
SecurityAuto-check passed
Defender Xdr
vinayaklatthe/microsoft-security-skills
Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with…
175 GitHub stars~2.1k tokensUpdated 3 mo ago
Backend & APIsAuto-check passed
Copilot For M365 Readiness
vinayaklatthe/microsoft-security-skills
Guidance for safely deploying Microsoft 365 Copilot — end-to-end readiness covering oversharing remediation, SharePoint Advanced Management (SAM) restricted sites and content discovery, sensitivity…
175 GitHub stars~2.1k tokensUpdated 3 mo ago
Documents & OfficeAuto-check passed
Defender For Office 365
vinayaklatthe/microsoft-security-skills
Guidance for Microsoft Defender for Office 365 (MDO) — protection for email and collaboration (Teams, SharePoint, OneDrive) against phishing, malware, spoofing, and business email compromise.
175 GitHub stars~2.6k tokensUpdated 3 mo ago
Documents & OfficeAuto-check passed
Defender For Storage
vinayaklatthe/microsoft-security-skills
Guidance for Microsoft Defender for Storage — threat protection for Azure Storage accounts (Blob, Files, Data Lake Gen2).
175 GitHub stars~2k tokensUpdated 3 mo ago
Documents & OfficeAuto-check passed

Questions about Detecting Spearphishing With Email Gateway

What does Detecting Spearphishing With Email Gateway do?

Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting…. Detecting Spearphishing With Email Gateway is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint, Mimecast, or Barracuda.

When should I use Detecting Spearphishing With Email Gateway?

Detecting Spearphishing With Email Gateway fits situations like: hardening a mail gateway against targeted phishing; investigating a suspected spearphishing campaign.

How do I install Detecting Spearphishing With Email Gateway in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a claude-code`. Or copy the skill folder (skills/detecting-spearphishing-with-email-gateway in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/detecting-spearphishing-with-email-gateway in your project. Claude Code loads it when a task matches its description.

How do I install Detecting Spearphishing With Email Gateway in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a codex`. Or copy the skill folder (skills/detecting-spearphishing-with-email-gateway in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/detecting-spearphishing-with-email-gateway in your project. Codex loads it when a task matches its description.

Can I use Detecting Spearphishing With Email Gateway in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/detecting-spearphishing-with-email-gateway, .gemini/skills/detecting-spearphishing-with-email-gateway, .github/skills/detecting-spearphishing-with-email-gateway and .opencode/skills/detecting-spearphishing-with-email-gateway in your project.

What does Detecting Spearphishing With Email Gateway need to run?

Going by SKILL.md and its folder, Detecting Spearphishing With Email Gateway needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Detecting Spearphishing With Email Gateway access the network?

SKILL.md names 4 domains. As links in the text: security.microsoft.com, proofpoint.com, mimecast.com and barracuda.com. This is read from the text; nothing was executed.

Is Detecting Spearphishing With Email Gateway safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Detecting Spearphishing With Email Gateway use?

Detecting Spearphishing With Email Gateway is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Detecting Spearphishing With Email Gateway use?

About 1.4k tokens (SKILL.md is roughly 5.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.1k tokens, read only when the agent opens those files.

What are the alternatives to Detecting Spearphishing With Email Gateway?

Skills that share tags, products or a category with Detecting Spearphishing With Email Gateway: Cloud App Security Posture (vinayaklatthe/microsoft-security-skills, 175 stars), Sentinel (vinayaklatthe/microsoft-security-skills, 175 stars), Defender Xdr (vinayaklatthe/microsoft-security-skills, 175 stars) and Copilot For M365 Readiness (vinayaklatthe/microsoft-security-skills, 175 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Detecting Spearphishing With Email Gateway?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Detecting Spearphishing With Email Gateway

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Detecting Spearphishing with Email Gateway

Overview

When to Use

Prerequisites

Key Concepts

Spearphishing Characteristics

Gateway Detection Layers

Workflow

Step 1: Configure Impersonation Protection

Step 2: Configure URL Protection

Step 3: Configure Attachment Sandboxing

Step 4: Create Custom Detection Rules

Step 5: Configure Alert and Response Actions

Tools & Resources

Validation

Files

Compare with similar skills

Similar skills

More from mukul975/Anthropic-Cybersecurity-Skills

Related

Questions about Detecting Spearphishing With Email Gateway