conducting-phishing-incident-response

by mukul975

The conducting-phishing-incident-response skill helps investigate suspicious emails, extract indicators, assess authentication, and recommend phishing response actions. It supports Incident Response workflows for message triage, credential-phishing cases, URL and attachment checks, and mailbox remediation. Use it when you need a structured guide instead of a generic prompt.

Stars0

Favorites0

Comments0

AddedMay 9, 2026

CategoryIncident Response

Install Command

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-phishing-incident-response

Curation Score

This skill scores 78/100, which means it is a solid listing candidate for directory users who need phishing incident response guidance. The repository shows a real, triggerable workflow with enough operational detail to help an agent do more than a generic prompt, though users should still expect some implementation-specific gaps before install.

78/100

Strengths

Strong triggerability: the frontmatter explicitly says it activates for phishing response, suspicious email reports, credential phishing, and remediation requests.
Real workflow depth: the docs and script cover email parsing, header/authentication checks, URL and attachment analysis, severity rating, and mailbox-wide remediation actions.
Helpful agent leverage: the repo includes a Python script and API reference with concrete functions and CLI usage for analyzing EML files and checking reputation services.

Cautions

The install path is not fully turnkey: there is no install command in SKILL.md, so users may need to wire dependencies and execution themselves.
Tooling appears partial: the repository references external APIs and a script, but the excerpted evidence does not show full end-to-end orchestration or documented remediation safeguards.

Phishing Email Security Threat Intelligence Virus Total Urlscan Security

Overview

Overview of conducting-phishing-incident-response skill

The conducting-phishing-incident-response skill helps an agent investigate a suspicious email, extract indicators, judge likely impact, and produce response actions for phishing cases. It is best for security analysts, SOC responders, and IT admins who need a structured phishing workflow rather than a generic incident-response prompt.

This conducting-phishing-incident-response skill is most useful when you already have an .eml file, message trace details, or a report that a user clicked, entered credentials, or received a malicious email. It focuses on email-header analysis, URL and attachment checking, severity rating, and mailbox remediation steps.

What it is good at

It supports phishing-specific work such as parsing email headers, reviewing SPF/DKIM/DMARC clues, extracting URLs and attachment hashes, and using reputation sources like VirusTotal and urlscan.io. The repo also includes an executable script, so this is more than guidance text: it can support a real analysis workflow.

Where it fits

Use this conducting-phishing-incident-response skill for phishing reports, credential-phishing investigations, and message containment. Do not expect it to handle broad account-takeover investigations or business email compromise workflows where the core question is internal impersonation or fraudulent payment activity.

Why people install it

People install the conducting-phishing-incident-response skill when they want faster triage, clearer decision-making, and a repeatable sequence for response. The main value is reducing guesswork: what to inspect first, what evidence matters, and when to escalate from a single message to org-wide cleanup.

How to Use conducting-phishing-incident-response skill

Install and inspect the skill

Use the conducting-phishing-incident-response install command from your skills manager, then open skills/conducting-phishing-incident-response/SKILL.md first. For deeper context, read references/api-reference.md and scripts/agent.py; those files show the intended analysis flow and the available automation points.

Start with the right input

The conducting-phishing-incident-response usage works best when your prompt includes the email artifact and the response goal. Strong inputs look like: the .eml file, sender and recipient context, whether a user clicked or submitted credentials, and any known URLs or attachment names. Weak inputs like “check this phishing email” leave the skill guessing about scope and severity.

Convert a rough request into a usable prompt

A good conducting-phishing-incident-response guide prompt is specific about deliverables and constraints. For example: “Analyze this .eml, extract indicators, assess authentication results, identify whether the message likely bypassed filtering, and draft containment steps for mailbox purge and credential reset.” That gives the skill enough structure to produce a usable incident-response output.

Follow the repo’s workflow artifacts

The repo’s practical path is: parse the message, extract URLs and attachment hashes, check reputation, assess authentication, then rate severity and recommend action. If you are implementing it yourself, the script exposes functions such as parse_email_file(), extract_urls(), and assess_phishing_severity(), which are the best places to mirror or extend the workflow.

conducting-phishing-incident-response skill FAQ

Is conducting-phishing-incident-response only for phishing?

Yes, the conducting-phishing-incident-response skill is centered on phishing email incidents. It is not a general mail-security or full IR framework, and it should not replace a dedicated BEC, malware, or identity-compromise procedure.

Do I need API keys to use it well?

For full conducting-phishing-incident-response usage, external lookups can require keys, especially VirusTotal. If you do not have API access, the skill can still help with header analysis and response planning, but reputation checking and automated scoring will be less complete.

Is this better than a normal prompt?

Usually yes, if your goal is consistent phishing analysis. A normal prompt may summarize the email, but the conducting-phishing-incident-response skill gives a more reliable sequence: triage, indicators, authentication, severity, and containment. That matters when you need an incident record, not just an opinion.

When should I not use it?

Do not use conducting-phishing-incident-response for confirmed internal account compromise, invoice fraud, or executive impersonation where the main problem is already inside the mailbox. In those cases, use the response path designed for account takeover or BEC.

How to Improve conducting-phishing-incident-response skill

Give the skill more evidence up front

The best results come from a complete incident packet: raw .eml, message IDs, headers, screenshot of the lure, URLs, attachment names, and whether the user interacted. The more of that you provide, the less the model has to infer, which improves conducting-phishing-incident-response quality.

Ask for the output you actually need

If your team needs action, ask for action. Good requests include “list indicators of compromise,” “rate severity,” “recommend containment,” or “draft an analyst handoff summary.” That keeps the conducting-phishing-incident-response skill from producing a vague narrative when you need a response checklist.

Watch for common failure modes

The biggest misses are incomplete email artifacts, no environment context, and unclear scope. If the message was forwarded, a screenshot is not enough; if the user clicked, say whether credentials were entered; if you need org-wide cleanup, mention mailbox scope and tooling. Those details materially affect conducting-phishing-incident-response output.

Iterate after the first pass

Treat the first result as triage, then refine. If the initial analysis finds suspicious URLs or failed authentication, rerun the conducting-phishing-incident-response skill with the extracted indicators, any VirusTotal or urlscan findings, and a narrower question such as “confirm whether this is credential theft or a benign false positive.”

Ratings & Reviews

No ratings yet

Share your review

0/10000

Latest reviews

Saving...

more skill

conducting-malware-incident-response

by mukul975

conducting-malware-incident-response helps IR teams triage suspected malware, confirm infections, scope spread, contain endpoints, and support eradication and recovery. It is designed for conducting-malware-incident-response for Incident Response workflows with evidence-backed steps, telemetry-driven decisions, and practical containment guidance.

Incident Response

Favorites 0GitHub 0

detecting-s3-data-exfiltration-attempts

by mukul975

detecting-s3-data-exfiltration-attempts helps investigate possible AWS S3 data theft by correlating CloudTrail S3 data events, GuardDuty findings, Amazon Macie alerts, and S3 access patterns. Use this detecting-s3-data-exfiltration-attempts skill for Security Audit, incident response, and suspicious bulk-download analysis.

Security Audit

Favorites 0GitHub 6.2k

analyzing-usb-device-connection-history

by mukul975

analyzing-usb-device-connection-history helps investigate USB device connection history on Windows using registry hives, event logs, and setupapi.dev.log for Digital Forensics, insider threat work, and incident response. It supports timeline reconstruction, device correlation, and removable-media evidence analysis.

Digital Forensics

Favorites 0GitHub 6.2k

analyzing-bootkit-and-rootkit-samples

by mukul975

analyzing-bootkit-and-rootkit-samples is a malware analysis skill for MBR, VBR, UEFI, and rootkit investigations. Use it to inspect boot sectors, firmware modules, and anti-rootkit indicators when compromise persists below the OS layer. It is suited for analysts who need a practical guide, clear workflow, and evidence-based triage for Malware Analysis.

Malware Analysis

Favorites 0GitHub 6.2k

extracting-browser-history-artifacts

by mukul975

extracting-browser-history-artifacts is a Digital Forensics skill for extracting browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge. Use it to turn browser profile files into timeline-ready evidence with repeatable, case-focused workflow guidance.

Digital Forensics

Favorites 0GitHub 0

detecting-ransomware-encryption-behavior

by mukul975

detecting-ransomware-encryption-behavior helps defenders spot ransomware-style encryption using entropy analysis, file I/O monitoring, and behavioral heuristics. It is suited for incident response, SOC tuning, and red-team validation when you need to detect mass file changes, rename bursts, and suspicious process activity quickly.

Incident Response

Favorites 0GitHub 0

detecting-privilege-escalation-attempts

by mukul975

detecting-privilege-escalation-attempts helps hunt privilege escalation on Windows and Linux, including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse. Built for threat hunting teams that need a practical workflow, reference queries, and helper scripts.

Threat Hunting

Favorites 0GitHub 0

detecting-evasion-techniques-in-endpoint-logs

by mukul975

The detecting-evasion-techniques-in-endpoint-logs skill helps hunt defense evasion in Windows endpoint logs, including log clearing, timestomping, process injection, and security tool disabling. Use it for threat hunting, detection engineering, and incident triage with Sysmon, Windows Security, or EDR telemetry.

Threat Hunting

Favorites 0GitHub 0

analyzing-network-traffic-for-incidents

by mukul975

analyzing-network-traffic-for-incidents helps incident responders analyze PCAPs, flow logs, and packet captures to confirm C2, lateral movement, exfiltration, and exploitation attempts. Built for analyzing-network-traffic-for-incidents for Incident Response with Wireshark, Zeek, and NetFlow-style investigation.

Incident Response

Favorites 0GitHub 0

detecting-credential-dumping-techniques

by mukul975

The detecting-credential-dumping-techniques skill helps you detect LSASS access, SAM export, NTDS.dit theft, and comsvcs.dll MiniDump abuse using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules. It is built for threat hunting, detection engineering, and Security Audit workflows.

Security Audit

Favorites 0GitHub 0

correlating-security-events-in-qradar

by mukul975

correlating-security-events-in-qradar helps SOC and detection teams correlate IBM QRadar offenses with AQL, offense context, custom rules, and reference data. Use this guide to investigate incidents, reduce false positives, and build stronger correlation logic for Incident Response.

Incident Response

Favorites 0GitHub 0

containing-active-breach

by mukul975

containing-active-breach is an incident-response skill for live breach containment. It helps isolate hosts, block suspicious traffic, disable compromised accounts, and slow lateral movement using a structured containing-active-breach guide with practical API and script references.

Incident Response

Favorites 0GitHub 0

configuring-suricata-for-network-monitoring

by mukul975

The configuring-suricata-for-network-monitoring skill helps deploy and tune Suricata for IDS/IPS monitoring, EVE JSON logging, rules management, and SIEM-ready output. It suits the configuring-suricata-for-network-monitoring for Security Audit workflow when you need practical setup, validation, and false-positive reduction.

Security Audit

Favorites 0GitHub 0

detecting-process-injection-techniques

by mukul975

detecting-process-injection-techniques helps analyze suspicious in-memory activity, validate EDR alerts, and identify process hollowing, APC injection, thread hijacking, reflective loading, and classic DLL injection for Security Audit and malware triage.

Security Audit

Favorites 0GitHub 0

detecting-business-email-compromise

by mukul975

The detecting-business-email-compromise skill helps analysts, SOC teams, and incident responders identify BEC attempts using email-header checks, social-engineering clues, detection logic, and response-oriented workflows. Use it as a practical detecting-business-email-compromise guide for triage, validation, and containment.

Incident Response

Favorites 0GitHub 6.1k

detecting-email-forwarding-rules-attack

by mukul975

The detecting-email-forwarding-rules-attack skill helps Security Audit, threat hunting, and incident response teams find malicious mailbox forwarding rules used for persistence and email collection. It guides analysts through Microsoft 365 and Exchange evidence, suspicious rule patterns, and practical triage for forwarding, redirect, delete, and hide behaviors.

Security Audit

Favorites 0GitHub 0