Second Look

Paste a suspicious text or email and get a plain-language second opinion: which scam tricks it uses, where its links really go, and what to do next.

Comment

Inspiration

Scam texts follow a small set of tricks: rush you, scare you, pretend to be someone you trust, ask for a code or an unusual payment. When someone gets one, the best help is usually a relative on the phone pointing at those tricks one by one. "Be careful" doesn't help in the moment; seeing exactly which words are the trick does. Second Look tries to be that second pair of eyes, especially for older adults, without sending their messages anywhere.

The idea came out of brainstorming with my AI agent for a project that is useful to ordinary people, free to run, and safe with private data. I picked it because it needs no paid API and protects the people most likely to be targeted.

What it does

  • Verdict: High / Medium / Low risk, with the number of warning signs and one plain sentence of advice.
  • Highlights: reprints the message with color-coded marks on the exact phrases: rush and pressure, unusual payment, asking for codes or private details, pretending to be someone you trust, "keep it secret", threats, too good to be true.
  • Tactic cards: one plain sentence per tactic explaining why scammers use it. Tapping a highlight jumps to its card.
  • Link check: shows the site you would actually visit and why it looks fake: a trusted name glued to the front of a different site, look-alike spelling, special characters that imitate letters, bare number addresses, shortened links, the "@" trick, unusual endings like .top.
  • Next 5 minutes: steps tailored to what was found, always ending with what to do if you already paid or shared something.
  • Ask someone I trust: copies a ready-to-send note with the verdict, reasons and the message.
  • Larger text mode (remembered), keyboard friendly, works on phones.
  • Private by design: no network requests after the page loads; nothing is uploaded. Even a "Low risk" result reminds you that no tool is a guarantee.

How we built it

I built Second Look with an AI coding agent, following the Devpost Skill Pack step by step: start → scope → PRD → spec → build → ship. The planning documents are in devpost/ and docs/SKILL_PACK_LOG.md is an honest log of the process.

My role: choosing the direction (a free, private tool for everyday people), reviewing and approving the plan, testing the app, and deciding what to publish. The agent's role: drafting the planning docs, writing the code and tests, and producing the demo video. I'm disclosing this openly because the Skill Pack is about learning to work with an AI agent.

  • Plain HTML, CSS and JavaScript modules. No framework, no build step, no dependencies. Hosted on GitHub Pages.
  • A rules engine (src/rules.js) with weighted tactic patterns, link parsing (including two-part endings like .co.uk) and a next-steps builder.
  • Built in 4 thin vertical slices, each checked with node --test and a headless-browser check.
  • 20 unit tests, including everyday messages that must stay "Low risk".
  • Demo video generated from the live app with a scripted browser, a free text-to-speech voice and ffmpeg, with burned-in captions.

Challenges we ran into

  • Double counting: a brand name inside a fake link was flagged as impersonation and again on the link card. Link words are now explained only by the link card.
  • The most important step got cut: "Already paid or shared something?" disappeared when the next-steps list was capped at six. It now always stays.
  • Layout: with many tactics, the highlighted message scrolled out of view on desktop, so it's now sticky; the verdict hid under the sticky header, fixed with scroll-padding-top.
  • No trademarks in the video: the samples were rewritten to be brand-free, and a general "fake name glued to the front of a different site" link rule was added.
  • False alarms: ongoing work. Tests make sure messages like "I'm fine, see you at dinner!" stay Low risk.

Accomplishments that we're proud of

  • Every warning points at the exact words. Nothing is a black box.
  • No API key, no cost, no data collection; it works offline once loaded.
  • Accessible: 18px base text, larger-text mode, keyboard support, and user text is never treated as HTML.
  • A planning trail that matches the code: scope → PRD acceptance criteria → tests.

What we learned

Writing the scope and PRD before any code made the agent's work far more predictable: every feature traced back to an acceptance criterion, and "done" meant tests passing, not "looks fine". We also learned that scam messages are built from a surprisingly small set of reusable tricks, which is what makes a transparent, rule-based checker useful. And with an AI agent, the human's most important job is deciding what not to build and checking results honestly.

What's next

  1. More languages, starting with Spanish. The rules are English-only today, and many targeted older adults don't read English.
  2. Screenshot input with on-device text recognition.
  3. "Share to Second Look" from the phone's share sheet (installable PWA).
  4. A practice ("teach me") mode built from the same rules.

Disclosures

  • Built with an AI coding agent following the Devpost Skill Pack; the rules allow AI coding assistants.
  • No pre-existing code, no third-party APIs or data. All sample messages are invented.
  • The demo video uses a free text-to-speech voice reading a script written with the agent.

Built With

Share this project:

Updates

Submission history