Link: Google Forms link with credential theft language

type.inbound
// cred_theft intent
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
// google form link
and any(body.current_thread.links,
        (
          .href_url.domain.domain == "docs.google.com"
          and strings.istarts_with(.href_url.path, '/form')
        )
        or .href_url.domain.root_domain == "forms.gle"
)
// new sender
and profile.by_sender_email().prevalence == "new"