Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsast abnormal
Investigate and remediate Abnormal Security email threats, account takeovers, and cases via CLI and MCP tools.
$49
ast abnormal
Example session with this skill installed
Check for any recent threats involving the sender "phish-test@example.com" and show me the detection details.
- Read your context and instructions
- Compiled the ast abnormal
I have searched Abnormal Security for threats associated with the sender phish-test@example.com.
Threat Investigation Results
| Timestamp (UTC) | Threat ID | Subject | Verdict | Command |
|---|---|---|---|---|
| 2023-10-27 14:22:01 | ABN-98234 | Urgent Invoice Attached | Malicious | abnormal-search threats --sender phish-test@example.com |
| 2023-10-27 15:05:12 | ABN-98255 | Final Notice: Security Alert | Suspicious | abnormal-search threats --sender phish-test@example.com |
Gaps
- The search was limited to the last 30 days of data.
- No audit logs were checked for manual overrides on these IDs.
- Results represent detections in the Abnormal platform only, not the underlying mail flow.
Next steps
1.
Remediate Threat: I can trigger a remediation action for ABN-98234 to pull it from the user's inbox. This
needs your approval.
2.
Detail Lookup: I can pull the full employee profile for the recipients of these messages to check for further signs of compromise.
3.
Report Detection: If ABN-98255 is a known safe sender, I can report it as a false positive. This
needs your approval.
Would you like to proceed with remediating the malicious threat?
Connects securely to your tools. The creator never sees your data.
About this skill
Managing Abnormal Security threats manually through a web dashboard slows down incident response. This skill provides a CLI and MCP-based interface for security engineers to investigate email threats, account takeovers, and vendor cases directly within their development or terminal environment.
What it does
- Threat investigation retrieves details on phish, account takeovers, and abuse-mailbox campaigns.
- Audit log analysis searches platform audit trails to track changes and detections.
- Remediation actions allows for remediating or unremediating threats and handling case actions.
- Employee profiling pulls profile data to correlate threats with specific users.
- Detection reporting submits reports for false positives or missed detections.
How it works
- Search uses
abnormal-searchor MCP tools for read-only lookups across threats and cases. - Propose generates a dry-run or action description for any remediation task.
- Approve requires the user to give explicit consent in the chat for any platform changes.
- Execute uses
abnormal-editto commit the approved change to the Abnormal platform.
Frameworks & tools
Built for Python 3.12+, this tool utilizes the Abnormal Security API, sectools for credential management, and the Model Context Protocol (MCP) for integration with AI clients like Claude Code.
Why this beats prompting it yourself
Prompting an LLM to "check Abnormal" fails because it lacks direct API access and an understanding of the specific safety gates required for security operations. This skill provides the necessary underlying tooling, credential handling, and structured investigation workflows that raw prompting cannot replicate.
Use cases
- Investigate a reported phishing link to see if Abnormal flagged the message.
- Remediate a confirmed threat across the tenant after a manual review.
- Audit account takeover cases to identify compromised internal identities.
- Report false positives to the Abnormal platform to tune detection logic.
Known limitations
Does not support Exchange Online message traces or purging. Limited to the api.abnormalplatform.com endpoint. Requires manual write-gate activation for MCP-based remediation.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 3 days ago
- Passed all security checks, Safe to install
Requires
macOS
Windows
Python