Skip to content
Get packs

Phishing Report Button Workflow

Set up a phishing report button and automate triage of user-reported emails

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill guides an AI agent through designing a system where employees can report suspicious emails with a button in Outlook or a similar client, and the reports are sent to a dedicated mailbox for automated triage. The agent can help plan the pipeline that classifies reports as phishing, spam, simulation or legitimate, extracts indicators such as URLs, sender details and attachment hashes, and proposes responses like retracting confirmed phishing and notifying reporters. Bundled Python scripts can parse .eml files, extract indicators, and compute reporting metrics.

Great for

  • Security operations teams deploying user phishing reporting in Microsoft 365 or Google Workspace
  • Engineers building SOAR automation for a reporting mailbox
  • Security awareness teams measuring user reporting rates in phishing simulations

Skip it if

  • Individuals wanting to protect their own personal email: the workflow assumes administrative access to enterprise email systems and SOAR tooling
  • Production use of the scripts without review: the triage logic is simple keyword and pattern matching, which can misclassify emails and should not drive automatic retraction or blocking unsupervised

Try asking

  • “Help me design a phishing report button rollout for Microsoft 365 users”
  • “Write a triage pipeline that extracts URLs and attachment hashes from reported .eml files”
  • “Create a feedback email template for users who report phishing”
  • “Calculate reporting rate and mean time to triage metrics from our reports file”
Step-by-step guide: how to use Phishing Report Button WorkflowInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    building-phishing-reporting-button-workflow.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-phishing-reporting-button-workflow.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-phishing-reporting-button-workflow.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review the scripts before running them, especially agent.py, since it imports requests and is described as calling external services; confirm exactly which endpoints it contacts and handle any API keys securely.
  • Test the classification logic on a sample of known phishing and legitimate emails before trusting it, and keep a human approval step before retraction or domain blocking.
  • Use the skill for planning and documentation, and treat the scripts as starting points to adapt rather than production-ready tools.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.