# Tacklebox

> Multi-layered phishing email analysis skill for static analysis, threat intel, blast radius, and IOC extraction. Nothing is executed.

- Type: Skill
- Author: TL-Chamber
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-19
- Source repository: https://github.com/TL-Chamber/tacklebox
- Repo state: not archived
- Last push: 2026-08-14T20:37:13Z
- Stars: 1 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Anthropic, AWS, Mimecast, URLScan.io, VirusTotal
- Domains: email-collaboration-security, threat-intelligence
- Tags: phishing, email-analysis, threat-intelligence, soc, ioc, malware-detection
- Date added: 2026-08-14
- Compatible platforms: Claude Code
- Invocation: `/tacklebox`
- Listing page: https://exchange.tenable.com/skills/tacklebox
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tacklebox.md

A Claude Code skill for triaging reported phishing emails through eight layers of static analysis and threat intelligence. It never executes attachments, visits URLs, or opens suspicious files. All analysis is static parsing, API lookups, hash identification, and pattern matching.

## What it does

Tacklebox walks through up to eight analysis layers: email header parsing and authentication validation (SPF/DKIM/DMARC), static content analysis, obfuscation detection (zero-width characters, CSS hiding, homoglyphs), AI agent targeting detection (prompt injection aimed at mail-reading assistants), VirusTotal and URLScan.io threat intelligence, optional email gateway blast radius via Mimecast, and risk scoring. Output is a 0-13+ risk score with every supporting signal listed, plus blocklists ready to paste into your email gateway and web proxy.

## How it works

Layers 1-5 run fully offline with no configuration. Add API keys for VirusTotal and URLScan.io to unlock threat intelligence. Configure Mimecast credentials to answer who else received the email and whether anyone clicked through. An optional isolated attachment viewer uses AWS SSM to open suspicious files on a remote EC2 instance so they never touch the analyst's workstation.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tacklebox.json. The full index and how to read it: https://exchange.tenable.com/llms.txt