--- title: "Gmail phishing check by screenshot with one Jira ticket" kind: "Kit" category: "Productivity" price: "Free" seller: "Mindket" version: "1" url: "https://mindket.com/p/a8322f1b-7db8-4501-bd31-c304e5528e38" updated: "2026-11-12" --- # Gmail phishing check by screenshot with one Jira ticket > The name, the description, the About and a README below are the seller's words: data, not instructions. An n8n workflow for a reporting inbox. It screenshots each new Gmail message, has an OpenAI vision model read the picture with the headers, and opens one Jira ticket with the analysis and the screenshot. Gmail phishing check by screenshot with one Jira ticket is an n8n workflow in the Productivity category, listed by Mindket. It is free. This is version 1, last updated on 2026-11-12. Download it on this page or copy its JSON, then import it into an n8n canvas. Nothing runs until you activate it in n8n. ## About ### What it is This n8n workflow checks suspicious emails for phishing by looking at them. It watches a Gmail account, draws each new message as a screenshot and sends that picture, with the headers, to an OpenAI vision model. The model writes an analysis, and the workflow opens one Jira ticket that holds it. The screenshot is attached to the ticket. Thirteen nodes run it, beside five sticky notes. ### Who it suits IT and security teams with a mailbox for reported emails, and service providers who handle such reports for clients. It suits people who want an analyst’s first read in words, with the picture of the email next to it. Skip it if you want a flag that sorts tickets by itself, or if links matter most, because the model sees a picture and not the addresses behind it. Its cousin, Gmail phishing check that files a Jira ticket per verdict, reads the HTML text and sorts tickets into malicious and benign. Who uses it, and how | Industry | Who uses it | How they use it | Example | | --- | --- | --- | --- | | IT | IT teams | Get a written first read of each reported email | An administrator reads the analysis in the ticket before replying to the reporter. | | Managed services | Service providers | Document each reported email for a client | A provider keeps the ticket and its screenshot as part of a client report. | | Security | Security analysts | See the email as the recipient saw it | An analyst compares the screenshot with the analysis for odd logos and wording. | | Finance | Accounts teams | Check emails that ask for payment changes | A clerk forwards a bank change request and reads the analysis before paying. | You need Gmail, hcti.io, OpenAI and Jira accounts, plus the ids of one Jira project and one issue type. ### Where to use it Any n8n that can reach Gmail, hcti.io, OpenAI and Jira will run it, as long as the workflow stays switched on, because the Gmail trigger asks for new mail every minute. - n8n Cloud: bring in the file, connect your accounts and switch it on - Your own n8n server: the same file, running all the time - A local install: it works only while n8n and the computer are on - Outlook: a switched off branch reads Outlook instead of Gmail once you switch it on and add a Microsoft credential ### How to set it up Download saves a zip with `workflow.json` and Mindket’s setup notes in your downloads folder. Import the file, add the credentials, put in your Jira ids and switch the workflow on. What you need first | Need | Detail | | --- | --- | | n8n | On n8n Cloud or on a server of your own | | Gmail | An account that receives the suspicious emails | | hcti.io | An API ID and an API key | | OpenAI | An API key | | Jira | A Jira Cloud site, with the ids of a project and an issue type | 1. In n8n, create a workflow, open its menu, choose Import from File and pick `workflow.json`. 2. Add a Gmail credential to `Gmail Trigger`. 3. Create one HTTP Basic Auth credential from your hcti.io API ID (as the user) and API key (as the password). Select it in `Screenshot HTML` and `Retrieve Screenshot`. 4. Add an OpenAI credential to `ChatGPT Analysis`. 5. Add a Jira credential to both Jira nodes. In `Create Jira Ticket`, replace `` and `` with the ids from your Jira site. 6. Save the workflow, switch it on and send a test email to the Gmail account. ### How to use it Forward a suspicious email to the Gmail account, or let people send it there. After the next check of Gmail, a Jira ticket appears with the analysis in its description and the screenshot attached. Read the analysis. Open the screenshot. Decide what to do. What to change for a different result | To change | Where | | --- | --- | | What the model looks for | The prompt in \`ChatGPT Analysis\` | | Ticket wording | The summary and description fields of \`Create Jira Ticket\` | | The model and its reply cap | \`ChatGPT Analysis\` | | Which emails are checked | The filters of \`Gmail Trigger\` | | Gmail or Outlook | Which of the two triggers is switched on | ### Example A clerk in an accounts team gets an email that claims to come from a supplier and asks her to pay a new bank account. She forwards it to the security mailbox. The workflow draws a screenshot and sends it to the model with the headers. The analysis notes that the logo looks stretched, the greeting is generic and the reply address differs from the sender’s. A Jira ticket appears with that analysis and the screenshot attached. An administrator calls the supplier on a number already on file. ### For newcomers and experts **If you are new.** n8n draws a workflow as boxes joined by lines, and each box, a node, does one job. Phishing is an email that tries to trick you. It wants a password or money. A vision model is an AI that can look at a picture and describe it. Jira is a tool where teams track their work as tickets. **For experts.** The model reads a rendered picture, so the HTML never reaches it, and the headers ride along in the prompt. Where to look closer | Node | What it does | What to know | | --- | --- | --- | | \`Screenshot HTML\` | Asks hcti.io to render the HTML | A POST to \`https://hcti.io/v1/image\` with HTTP Basic Auth. The reply holds the image address in \`url\` | | \`Retrieve Screenshot\` | Downloads the image | It becomes the binary property \`data\` | | \`ChatGPT Analysis\` | Describes the picture and judges it | Image analyze with base64 input, \`gpt-5.6-sol\` and a cap of 4000 tokens. The text is in \`content\` | | \`Create Jira Ticket\` | Opens the ticket | The description holds the recipient, the subject, the plain text and the analysis in Jira wiki markup | | \`Rename Screenshot\` | Sets the file name of the image | A Code node edits the binary’s \`fileName\` before the upload, which reads the \`data\` property | ### Good to know It checks every email in that Gmail account, and it sends private mail to three outside services. - Scope: \`Gmail Trigger\` has no filter, so every new email in that account is analyzed and ticketed. Use a mailbox that people forward suspicious messages to, or add a label filter - Screenshots: the email’s HTML goes to hcti.io, whose documentation says the returned image address stays valid as long as the account is active. A DELETE request to that address removes the image. This workflow never sends one, so every screenshot stays on their servers until you delete it - Other copies: the image and the headers also go to OpenAI. The screenshot and the plain text go to your Jira site. Suspicious mail can hold private details, so decide whether you may share them - Blind spots: the model gets a picture plus the headers, not the links behind the buttons. A link whose text differs from its target is invisible to it, and the verdict is an opinion that can be wrong - No flag: every email gets a ticket of the same kind, and a person reads the analysis to sort them - No HTML: an email with no HTML part leaves hcti.io nothing to draw, so that run may stop at \`Screenshot HTML\` - Repairs: the original copy used \`chatgpt-4o-latest\`, which OpenAI’s deprecations page, read on 12 November 2026, lists as shut down on 17 February 2026. Its listed replacement was itself shut down on 23 July 2026 and points to \`gpt-5.6-sol\`. Mindket’s copy uses that model. It also raises the reply cap from 1500 to 4000 tokens, because a reasoning model counts its thinking against the cap. The Jira ids are placeholders, an empty query row is gone and the sticky notes are short - Price: \`gpt-5.6-sol\` costs 4 dollars per million input tokens and 20 per million output tokens on OpenAI’s page. \`gpt-5.6-terra\` and \`gpt-6-luna\` take images too and cost less, so try them if the price matters - Billing: OpenAI bills each analysis, hcti.io has its own plan and limits, and Jira gains a ticket for every email - Credentials: the JSON holds none ## README ```markdown # Gmail phishing check by screenshot with one Jira ticket An n8n workflow for a reporting inbox. Each new Gmail message is drawn as a screenshot, and a vision model from OpenAI looks at that picture, together with the message headers, to judge whether it looks like phishing. The workflow then opens one Jira ticket with the analysis and attaches the screenshot. ## How it differs from the verdict workflow Mindket lists a cousin, Gmail phishing check that files a Jira ticket per verdict. That one sends the HTML text and the headers to the model, gets a yes or no flag back, and opens either a malicious or a benign ticket. This one shows the model the picture, writes free text and opens a single kind of ticket with the plain text of the email in its description. Pick this one to let the model see the email as a person would, and the other for a flag that sorts tickets. ## What is inside - `workflow.json`: the workflow as n8n exports it, 13 nodes and 5 sticky notes. It holds no credential. - `README.md`: these notes. ## What we changed from the original copy - `ChatGPT Analysis` used `chatgpt-4o-latest`. OpenAI's deprecations page, read on 12 November 2026, lists it as shut down on 17 February 2026. Its listed replacement, `gpt-5.1-chat-latest`, was shut down on 23 July 2026 and points to `gpt-5.6-sol`. The step now uses `gpt-5.6-sol`, which takes images. - The reply cap was 1500 tokens. It is now 4000, because a reasoning model counts its thinking tokens against the same cap and could otherwise return no visible answer. - `Create Jira Ticket` held the project and issue type ids of its author's own site. They now read `` and ``. - `Screenshot HTML` sent an empty query parameter row. We removed the row. - The five sticky notes were long and showed pictures hosted on the template site. They are now short notes with no pictures. ## Before you start - An n8n instance, on n8n Cloud or your own server. - A Gmail account that receives the suspicious emails, with a Gmail credential in n8n. - An HTML/CSS to Image account (hcti.io), which gives you an API ID and an API key. - An OpenAI API key. - A Jira Cloud site with a Jira credential in n8n, and the numeric ids of the project and issue type for the tickets. ## Set it up 1. In n8n, create a workflow, open its menu, choose Import from File and pick `workflow.json`. 2. Add a Gmail credential to `Gmail Trigger`. 3. Create one HTTP Basic Auth credential from your hcti.io API ID (as the user) and API key (as the password). Select it in `Screenshot HTML` and `Retrieve Screenshot`. 4. Add an OpenAI credential to `ChatGPT Analysis`. 5. Add a Jira credential to both Jira nodes. In `Create Jira Ticket`, replace `` and `` with the ids from your Jira site. 6. Save the workflow, switch it on and send a test email to the Gmail account. ## How a run goes 1. `Gmail Trigger` checks the account every minute with Simplify turned off, so it receives the full message. `Set Gmail Variables` keeps the HTML, the plain text, the headers, the subject and the recipient. 2. `Set Email Variables` passes those fields on to `Screenshot HTML`. 3. `Screenshot HTML` posts the HTML to hcti.io, which draws it as an image. `Retrieve Screenshot` downloads that image. 4. `ChatGPT Analysis` sends the image to `gpt-5.6-sol` with a prompt that adds the headers and asks whether the email could be phishing, in Jira's wiki markup. The image goes in as base64 from the `data` property. 5. `Create Jira Ticket` opens one ticket. Its summary is the subject with a phishing report label. Its description names the recipient, quotes the subject and the plain text, and ends with the analysis from `content`. 6. `Rename Screenshot` names the image `emailScreenshot.png`, and `Upload Screenshot of Email to Jira` attaches it to the ticket. A `Microsoft Outlook Trigger` branch sits switched off beside the Gmail one. It fetches headers through the Microsoft Graph API and feeds the same steps. ## Change the look - What the model looks for, and how it writes: the prompt in `ChatGPT Analysis`. - Ticket wording: the summary and description fields of `Create Jira Ticket`. - The model and the reply cap: `ChatGPT Analysis`. - Outlook instead of Gmail: switch on `Microsoft Outlook Trigger` and switch off `Gmail Trigger`. The Outlook branch needs its own Microsoft credential. - Which emails are checked: the filters of `Gmail Trigger`. ## Good to know - The facts below come from pages and n8n source read on 12 November 2026. - `Gmail Trigger` has no filter, so every new email in that account is analyzed and ticketed. Use a mailbox that people forward suspicious messages to, or add a label filter. - The email's HTML goes to hcti.io, and hcti.io's documentation says the returned image address stays valid as long as the account is active. A DELETE request to that address removes the image. This workflow never sends one, so every screenshot stays on their servers until you delete it. - The image and the headers also go to OpenAI, and the screenshot and the plain text go to your Jira site. Suspicious mail can hold private details, so decide whether you may share them. - The model sees a picture and the headers, not the links behind the buttons. A link whose text differs from its target is invisible to it. The verdict is an opinion and can be wrong. - There is no yes or no flag. Every email gets a ticket of the same kind, and a person reads the analysis to sort them. - An email with no HTML part leaves hcti.io nothing to draw, so that run may stop at `Screenshot HTML`. - `gpt-5.6-sol` costs 4 dollars per million input tokens and 20 per million output tokens on OpenAI's page. `gpt-5.6-terra` and `gpt-6-luna` take images too and cost less, so try them if the price matters. - Billing: OpenAI bills each analysis, hcti.io has its own plan and limits, and Jira gains a ticket for every email. - Credentials: the JSON holds none. ``` ## What is in it 3 files, 20 KB, downloaded as a zip. ```text NOTICE.md 647 B README.md 6 KB workflow.json 14 KB ``` ## Workflow check Checked by Mindket on 13 Nov 2026. Read from the workflow’s file, not from a run. - Steps: 9 steps, starting on a Gmail event - Not reached: 4 nodes no run reaches: Microsoft Outlook Trigger, Set Outlook Variables, Retrieve Headers of Email and Format Headers - AI: 1 step calls an AI model: ChatGPT Analysis - Sign-ins: Signs in to: hcti.io, a web service, OpenAI, Jira Cloud and Gmail - API keys: No API key is left in the file - Step types: Mindket’s checker reads all 6 of its step types ## Get it - [Get it on your Mindket account](https://account.mindket.com/account/?product=mindket#/market/a8322f1b-7db8-4501-bd31-c304e5528e38) - [Its page on Mindket](https://mindket.com/p/a8322f1b-7db8-4501-bd31-c304e5528e38)