Check suspicious links people forward to you

import base64, re
from email.message import EmailMessage
from google.oauth2.credentials import Credentials
from googleapiclient.discovery import build
from clickruntime import on_trigger, credentials, http, state, notify, report_fetched

def vt(kind, value, key):
    if kind == "urls":
        value = base64.urlsafe_b64encode(value.encode()).decode().strip("=")
    r = http.get(f"https://www.virustotal.com/api/v3/{kind}/{value}", headers={"x-apikey": key})
    return r.json()["data"]["attributes"]["last_analysis_stats"] if r.ok else None

@on_trigger
def run(event):
    gmail = build("gmail", "v1", credentials=Credentials(credentials.connection("google", "work")), cache_discovery=False)
    seen = set(state.get("seen") or [])
    msgs = gmail.users().messages().list(userId="me", q="to:security@ newer_than:1d", maxResults=20).execute().get("messages", [])
    new = [m for m in msgs if m["id"] not in seen]
    report_fetched(len(new))
    if not new:
        return {"new": 0}
    key = credentials.secret("VIRUSTOTAL_API_KEY")
    for m in new:
        msg = gmail.users().messages().get(userId="me", id=m["id"], format="full").execute()
        h = {x["name"]: x["value"] for x in msg["payload"]["headers"]}
        text = msg["snippet"] + " " + " ".join(base64.urlsafe_b64decode(p["body"].get("data", "") + "==").decode(errors="ignore")
                                               for p in msg["payload"].get("parts", [msg["payload"]]))
        found = [("urls", u) for u in set(re.findall(r"https?://[^\s<>\"']+", text))][:5]
        found += [("ip_addresses", ip) for ip in set(re.findall(r"\b(?:\d{1,3}\.){3}\d{1,3}\b", text))][:5]
        lines = [f"{v}: {s['malicious']} malicious, {s['suspicious']} suspicious" if s else f"{v}: not found"
                 for (k, v), s in ((f, vt(*f, key)) for f in found)]
        report = "\n".join(lines) or "No links or IPs found."
        notify.slack(f"🛡 Report from {h.get('From')}: {h.get('Subject')}\n{report}", channel="#security")
        reply = EmailMessage()
        reply["To"], reply["Subject"] = h.get("From"), "Re: " + h.get("Subject", "")
        reply["In-Reply-To"] = reply["References"] = h.get("Message-ID", "")
        reply.set_content(f"Thanks for reporting this. VirusTotal results:\n\n{report}")
        gmail.users().messages().send(userId="me", body={"raw": base64.urlsafe_b64encode(reply.as_bytes()).decode(),
                                                         "threadId": msg["threadId"]}).execute()
    state.set("seen", [m["id"] for m in msgs])
    return {"reports": len(new)}