mail-security

Identify security-related emails from Apple Mail using Python and sqlite3.

5|Updated Feb 28, 2026
One-click install
npx skills add https://github.com/aashari/ai-agent-skills --skill mail-security
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: mail-security
Source: https://github.com/aashari/ai-agent-skills/tree/main/skills/apple-mail/mail-security
Command: npx skills add https://github.com/aashari/ai-agent-skills --skill mail-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Find security-related emails — login alerts, 2FA changes, password resets, new device notifications, suspicious activity, and account security events across all accounts. Use when user asks about security alerts in their email, account access notifications, or wants to review security events. Arguments: optional time range or account/service filter.

Core Features & Use Cases

  • Detect and surface security events (login alerts, 2FA changes, password resets, new device notifications) from Apple Mail.
  • Allow filtering by time range and per-account or per-service to focus investigations.
  • Provide structured details for each event to review in context (service, event type, location, device, timestamp).

Quick Start

Scan your Mail data for security-related events and report findings for the last 30 days.

Frequently Asked Questions about mail-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check email security alerts for login attempts and 2FA changes?

To find email security alerts, the Skill scans local mail data to identify login attempts, 2FA changes, password resets, and new device notifications. It parses emails using Python and queries local data with sqlite3 to surface relevant security events.

What types of account security events can I detect in Apple Mail?

You can detect login alerts, 2FA changes, password resets, new device notifications, and suspicious activity events. The Skill extracts structured details for each event, including the service, event type, location, device, and timestamp.

Can I filter security event reviews by a specific time range or mail account?

Yes, you can filter security events by an optional time range or per-account and per-service. This allows you to focus investigations on specific timeframes or isolate activity within individual mail accounts.

Do I need sqlite3 and Python to parse email security events locally?

Yes, the Skill requires local mail data access and utilizes sqlite3 for queries along with Python for parsing and post-processing to identify and structure security-related emails across your accounts.

What is the best way to review recent suspicious activity and password reset emails?

The best way to review recent suspicious activity is to request a security event review with an optional time window. The Skill scans all mail accounts to detect and report findings for password resets and other security alerts.