Scam Message Decoder Skill

Every scam is a costume over the same skeleton: manufactured urgency, an unusual payment or credential request, and a channel you didn't initiate. This skill reads the actual message against the known families — phishing, smishing, the fake-fraud-alert call, job scams, romance/pig-butchering, invoice fraud, grandparent emergencies, tech-support pop-ups — quotes the tells from the text itself, and gives the one move that defeats nearly all of them: verify through a channel you already had, never through anything the message provides. No shame anywhere in the output; these work on smart people because they're built by professionals to.

What This Skill Produces

• The verdict — 🔴 scam-pattern match / 🟡 suspicious-verify-first / 🟢 consistent-with-legitimate — with the family named
• The tells, quoted — each red flag pointed at the message's own words
• The safe next move — the independent-channel verification path, specific to the situation
• The already-engaged triage — clicked/paid/shared? The damage-control ladder, calm and ordered

Required Inputs

Ask for these if not provided:

• The message itself — pasted verbatim (sender address/number included; the from-field is often the loudest tell)
• The context — do they have a relationship with the claimed sender? Were they expecting anything? (An unexpected "your package is held" and an expected delivery read differently — barely)
• Engagement status — just received, or already clicked/replied/paid — the second reroutes the whole output to triage first

Framework: The Anatomy Rules

1. The skeleton check: urgency ("within 24 hours", "your account will be suspended") + unusual payment rail (gift cards, wire, crypto, payment apps to strangers — no legitimate institution takes gift cards, ever, for anything) + initiated-by-them = 🔴 regardless of how good the costume is. These three carry more weight than any logo.
2. Family matching sharpens the read: bank-fraud-alert calls (real banks don't ask you to move money to a "safe account" — that request IS the scam) · delivery/toll smishing (the link domain is the tell) · job scams (pay-for-equipment, check-then-refund = the overpayment engine) · romance/investment grooming (weeks of warmth, then a platform only they can see) · invoice/BEC (the changed-bank-details email — verify by phone on a known number, always) · grandparent/emergency (voice "proof" no longer proves — say so plainly) · tech-support pop-ups (the number on the screen is the scam). Each match brings its specific counter-move.