Mailscope Email Detection

Use this skill when the user wants to perform security analysis on an email (.eml) file. The skill provides a comprehensive security assessment report by uploading the file to the Mailscope analysis platform.

Language

Respond in the user's language. If they write in Chinese, reply in Chinese; if English, English. Keep technical tokens (paths, flags, field names) in English.

Workflow

Step 0: Configure API Key

When the user provides an API key (e.g., "我的 key 是 msk_xxx", "帮我配置 API Key", "set api key to msk_xxx", "这是key: msk_xxx"), write it into config.json:

1. Check if config.json exists in the skill root directory. If not, read config.json.example as a template and create config.json from it.
2. Read the current config.json and parse it as JSON.
3. Set the api_key field to the key the user provided.
4. Write the updated JSON back to config.json (use 2-space indentation for readability).
5. Confirm to the user: "API Key 已配置成功。"

The user gets their API key by applying at https://x.lizhisec.com. If they ask where to get one, point them there.

Step 1: Check prerequisites

Before running the analysis, verify these conditions are met:

1. Node.js 22+ is available. Check with node --version. If not available, tell the user to install Node.js 22+.
2. config.json exists with a valid api_key. If missing, guide the user through Step 0 above.

Step 2: Run the analysis script

npx tsx scripts/analyze.ts <path/to/email.eml>

The script will:

1. Upload the .eml file to the analysis platform
2. Poll for results every 3 seconds until analysis completes
3. Display a formatted security analysis report

Step 3: Interpret results for the user

The report output is self-contained and human-readable. Key elements to help the user understand:

• 风险等级 (Risk Tier): risky (dangerous), clean (safe), or other levels
• 置信度 (Confidence): AI confidence percentage
• 身份认证 (Authentication): SPF, DKIM, DMARC results
• 域名信息 (Domain Profile): Registration date, ICP record - recently registered domains are suspicious
• AI 综合分析 (AI Analysis): Detailed threat assessment covering identity verification, behavioral patterns, intent recognition, and comprehensive judgment

If the email is flagged as risky, emphasize the recommended actions:

• Isolate the email immediately
• Block the sender domain
• Do NOT open attachments or enter passwords
• Preserve the .eml file for forensics

Error handling

Common errors and how to address them:

What NOT to do

• Do NOT read raw JSON from the API response and present it directly to users
• Do NOT hardcode any API keys in responses visible to the user
• Do NOT modify config.json unless the user explicitly asked you to configure their API key (see Step 0)
• Do NOT expose the API_BASE_URL configuration to users (internal detail)