Link: Gmail confidential mode message with job scam subject

type.inbound
and any(body.current_thread.links,
        .href_url.domain.domain == "confidential-mail.google.com"
        and strings.istarts_with(.href_url.path, "/msg/")
)
and (
  // the sender-controlled subject is rendered as the link text
  any(filter(body.current_thread.links,
             .href_url.domain.domain == "confidential-mail.google.com"
      ),
      any(ml.nlu_classifier(.display_text).intents,
          .name == "job_scam" and .confidence in ("medium", "high")
      )
      // compensation figures such as "$450K–$900K+"
      or any(ml.nlu_classifier(.display_text).entities,
             .name == "financial" and regex.contains(.text, '\d\s*[kKmM]\b')
      )
      // recruitment terms in the subject
      or regex.icontains(.display_text,
                         '\b(?:leader(?:ship)?|director|mandate|opportunit(?:y|ies)|executive.search|career|jobs?|role)\b'
      )
  )
  // recruitment terms in the sender local part
  or regex.icontains(sender.email.local_part,
                     '(?:recruit|talent|staffing|executive.?s[ea]|career)'
  )
)