Phishing Incident Response
Triage reported phishing emails, check URLs and attachments, and guide containment and account cleanup.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent follows a structured playbook when someone reports a suspicious email. It helps read email headers to judge whether the sender is spoofed, outlines how to check links and attachments in a sandbox, estimates how many people interacted with the email, and lists containment steps such as purging the message, blocking the sender, forcing password resets, revoking sessions and checking for attacker mailbox forwarding rules. It also includes a Python helper that parses .eml files and extracts header and authentication results.
Great for
- Security analysts or SOC staff handling user-reported phishing
- IT administrators running Microsoft 365 or Google Workspace who need a repeatable response checklist
- Students learning email header analysis and phishing incident handling
Skip it if
- Business email compromise involving an internal compromised account; the skill itself says to use BEC procedures instead
- Anyone without admin rights to the mail and identity systems, since most steps cannot be carried out without them and the commands could cause account lockouts if run carelessly
- Production use without review: the bundled script imports requests and the instructions include destructive actions such as purging mail and revoking tokens, which should be checked by a qualified responder first
Try asking
- “Analyze this .eml file and tell me whether it is confirmed phishing, suspicious or spam.”
- “Walk me through scoping who clicked the link in a phishing email that reached 47 users.”
- “Give me the PowerShell steps to revoke sessions and check forwarding rules for a user who entered credentials.”
- “Help me extract SPF, DKIM and DMARC results from this suspicious email's headers.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
conducting-phishing-incident-response.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip conducting-phishing-incident-response.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip conducting-phishing-incident-response.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Start with the header analysis and classification step before running any containment action, so purges and account resets are based on evidence.
- Keep analysis in a sandbox or isolated environment; never open suspicious attachments or click links on a production workstation.
- Review scripts/agent.py and its network calls before running it, and use a test account or non-production tenant first, since the skill is described as automating response actions.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.