Guide · Agent skill
How to use the Phishing Report Button Workflow agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the building-phishing-reporting-button-workflow agent skill does, how to install it, and how to ask an AI agent to use it. It is written for security operations and engineering teams who want help designing a user phishing-report button and an automated triage pipeline for the reporting mailbox. By the end you will know how to install the skill, phrase useful requests, and understand its limits and requirements.
Phishing Report Button Workflowmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page and unzip it on your machine.
- 2Place the skill folder. Move the unzipped folder into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload it in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Check the requirements. Confirm you have Python 3, the requests library, and the admin access and SOAR platform your deployment needs.
- 5Ask with a natural request. Describe your email platform and goal, for example a triage rule table for user-reported emails.
- 6Review the output. Check classifications, thresholds and any scripts against your environment before using them.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md instruction file, plus optional reference documents, templates and scripts, that an AI agent can load when a task matches the skill's description. This skill covers implementing a phishing report button, such as the Microsoft 365 built-in Report button or a third-party option like KnowBe4 or Cofense, with a SOAR-driven triage workflow.
Once loaded, the agent can help plan a system where employees report suspicious emails from Outlook or a similar client, and those reports land in a dedicated mailbox for automated triage. The agent can help classify reports as phishing, spam, simulation or legitimate, extract indicators such as URLs, sender details and attachment hashes, and propose responses such as retracting confirmed phishing and notifying reporters.
- Deploy the report button and route reports to a reporting mailbox
- Design triage that classifies reports and extracts indicators
- Propose response actions and reporter feedback
- Track reporting metrics, including user report rate in phishing simulations
Who is this skill for, and who should skip it?
The skill is aimed at security operations teams deploying user phishing reporting in Microsoft 365 or Google Workspace, engineers building SOAR automation for a reporting mailbox, and security awareness teams measuring reporting rates in phishing simulations.
It is not meant for individuals protecting their own personal email. The workflow assumes administrative access to enterprise email systems and SOAR tooling.
Install the skill
Download the ZIP file from the skill's page on this site and unzip it. You can install it in one of two ways.
For personal use with Claude Code, unzip the folder into ~/.claude/skills/. To scope it to one project, unzip it into the project's .claude/skills/ folder.
In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
What you need before you start
The skill's workflow expects several things to be in place before a real deployment. Check these first so the agent's plan matches your environment.
- Python 3 and the requests library, which scripts/agent.py uses
- Microsoft 365 or Google Workspace admin access for a real deployment
- A SOAR platform such as Microsoft Sentinel, Splunk SOAR or Cortex XSOAR
- Optional third-party API keys for VirusTotal and URLScan.io, referenced in the workflow
- A dedicated reporting mailbox and an email security gateway with message retraction capability
How to trigger the skill with natural requests
You do not need special syntax. Describe the task in plain language that matches the skill's purpose, and the agent will load it when relevant. Name the platform and the goal so the answer is specific.
Good requests name your email platform, the stage you are at, and what you want back, such as a triage rule table or a metrics plan.
- Help me design a phishing report button workflow for Microsoft 365 that routes reports to a reporting mailbox.
- Create a triage rule table that classifies reported emails as phishing, spam, simulation or legitimate.
- Which indicators should my SOAR playbook extract from user-reported .eml files?
- Draft a metrics plan for user reporting rate in our phishing simulations.
Use the bundled scripts safely
The skill includes scripts/process.py and scripts/agent.py. The bundled Python scripts can parse .eml files, extract indicators and compute reporting metrics. agent.py uses the requests library, and the skill uses the network: the workflow references VirusTotal and URLScan.io lookups that need API keys.
The triage logic is simple keyword and pattern matching. It can misclassify emails, so review the scripts before running them on real mail, and do not let them drive automatic retraction or blocking without human supervision. Keep API keys out of shared files and test against sample messages first.
- Review scripts/agent.py and scripts/process.py before running them
- Test with sample .eml files, not live mailboxes
- Keep automatic retraction and blocking under human approval
Tips for getting useful results
Give the agent your actual constraints, such as which SOAR platform you run and whether you already use a third-party reporting button. The skill's reference files cover the API lookups, indicator weights and standards mappings, so ask the agent to draw on them when you need specifics.
Treat the output as a design draft. The template in assets/template.md is a useful starting point for button configuration, triage rules and a metrics dashboard.
- Name your platform and SOAR tool in the first message
- Ask for the template in assets/template.md to be filled in for your environment
- Ask the agent to explain its classification thresholds so you can check them
What people use it for
- Planning a Microsoft 365 Report button rollout that routes reports to a dedicated reporting mailbox.
- Drafting triage rules that classify reported emails as phishing, spam, simulation or legitimate.
- Listing the indicators a SOAR playbook should extract from reported .eml files, such as URLs, sender details and attachment hashes.
- Designing a reporter feedback loop, including a thank-you reply and a classification result.
- Setting up metrics for mean time to triage and user report rate in phishing simulations.
Frequently asked questions
How do I install the building-phishing-reporting-button-workflow skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
What do I need to run this skill?
You need Python 3 and the requests library for the bundled agent.py script. A real deployment also requires Microsoft 365 or Google Workspace admin access and a SOAR platform such as Microsoft Sentinel, Splunk SOAR or Cortex XSOAR. VirusTotal and URLScan.io API keys are optional.
Is this skill free to use?
The source does not state pricing for the skill. It is licensed under Apache-2.0, which you should review directly. Some referenced services, such as VirusTotal, URLScan.io and SOAR platforms, are separate products with their own terms.
Can this skill protect my personal email?
No. The workflow assumes administrative access to enterprise email systems and SOAR tooling, so it is aimed at organizations rather than individual mailboxes.
Are the scripts safe to run on real email?
Review them first and test with sample .eml files. The triage logic is simple keyword and pattern matching that can misclassify emails, so it should not drive automatic retraction or blocking unsupervised.
How does this compare with other phishing reporting tools?
The skill's reference covers Microsoft's built-in Report button alongside third-party options such as Cofense Reporter, KnowBe4 Phish Alert Button, Proofpoint CLEAR and Hoxhunt. The skill helps design the workflow around them, but it does not replace those products.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security operations or engineering team designing user phishing reporting and SOAR triage in Microsoft 365 or Google Workspace, and you can review its scripts and keep humans in the loop. Skip it if you only want to protect personal email or need a production-ready, fully automated classifier, since its triage is basic pattern matching.
Download the skill