How to use the Phishing Incident Response agent skill

What the skill makes the agent do

Once installed, the agent follows a step-by-step phishing response process when someone reports a suspicious email. The playbook covers triage, analysis of URLs and attachments, scoping who received and interacted with the message, containment, recovery and post-incident steps.

During triage the agent helps you read email headers to judge whether the sender is spoofed. The checklist compares Return-Path, From, Reply-To, SPF, DKIM, DMARC and the Received chain, and classifies the message as confirmed phishing, suspicious, spam or legitimate.

• Triage: read headers and extract the email as .EML or .MSG so headers are preserved
• Analysis: check URLs against VirusTotal, URLscan.io and Google Safe Browsing, and detonate attachments in a sandbox
• Scope: estimate how many recipients received, opened, clicked or entered credentials
• Containment: purge the message, block the sender domain and URL, force password resets, revoke sessions, and check for attacker forwarding rules
• Helper script: scripts/agent.py parses .eml files and extracts header and authentication results

How to install the skill

Download the ZIP from this page and unzip it. You can install the skill for yourself or for a single project. For a personal install, place the unzipped skill folder in ~/.claude/skills/. For a project install, place it in the project's .claude/skills/ folder.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills. Use this route if you are not working from a local folder.

The package contains SKILL.md, scripts/agent.py and references/api-reference.md. Keep this folder structure intact so the agent can find the script and reference file.

Check the requirements before you run anything

The skill itself does not replace your security tooling. Most steps depend on accounts and systems you must already have access to. Confirm these before starting a real incident.

The helper script needs Python 3 and the requests library, which it imports. The example PowerShell commands need the AzureAD module. Most containment steps cannot be carried out without admin rights to the mail and identity systems.

• Email security gateway with message trace and quarantine, such as Microsoft Defender for Office 365, Proofpoint or Mimecast
• Microsoft 365 or Google Workspace admin account for mailbox search and purge
• Malware sandbox and threat intel accounts such as ANY.RUN, Joe Sandbox, VirusTotal or URLscan.io
• Identity provider access such as Azure AD or Okta
• PowerShell with the AzureAD module for the example commands

Trigger the skill with natural requests

You do not need a special command to use the skill. Describe the situation in plain language and the agent should apply the playbook when your request matches its scope. The skill's description covers reported phishing emails, suspected spearphishing and mailbox-wide purges.

Give the agent as much context as you can: the email file, what the user did (clicked, opened an attachment, entered a password), and whether you have admin access to the mail and identity systems.

• I have a reported phishing email saved as suspicious_email.eml. Help me judge whether the sender is spoofed.
• A user says they entered their password on a login page from an email. Walk me through containment.
• We need to purge a phishing message from all mailboxes. Give me the search and purge checklist.
• Check this email's SPF, DKIM and DMARC results and tell me what they mean.

Run the helper script on an .eml file

The bundled script parses an .eml file and extracts header and authentication results. Its reference lists functions that extract URLs from the plain text and HTML parts, extract attachment names, types and sizes, and compute SHA-256 and MD5 hashes. It can also check URL and file reputation through the VirusTotal API when you supply a key.

Run it from the skill folder with the command below. Replace the file names with your own. Do not paste a real API key into a shared document or ticket.

• Without a --vt-key value, reputation lookups are not performed, so use the header and parsing output on its own
• The output is written to the file named after --output

Example: contain a user who entered credentials

If a user has entered credentials on a phishing page, the skill lists the account steps to take. The example PowerShell below revokes refresh tokens, forces a password change at next sign-in, and lists inbox rules that forward or redirect mail. Read each line and confirm the user object before running it, because the source warns these actions can lock accounts if run carelessly.

Remove a suspicious rule only after you have reviewed it and recorded its name. The skill also asks you to review sign-in activity and check for unauthorized OAuth application grants.

Tips for working with the agent

Ask the agent to work in stages. Triage and header analysis can be done on a copy of the email with no changes to any system. Purging, blocking and token revocation should only follow review by a qualified responder.

Keep a record of every indicator, hash and action. The skill's Step 1 classification and Step 3 scope table are easy to paste into a ticket. Monitor affected accounts for 72 hours, as the playbook recommends, and check for data exfiltration during the exposure window.

• Triage on copies, not originals
• Log indicators, hashes and each containment action with a time
• Involve the mailbox owner and your legal or HR contacts before disciplinary steps
• Do not use this skill for business email compromise involving an internal account; follow your BEC procedure instead