Assess reported phishing emails by checking sender authentication, links, and attachments. Post a risk rating, supporting evidence, and a recommended action to Slack, leaving blocking, deletion, and other changes to the security team.
The phishing-report triage runbook — how to check headers, links, and attachments on a reported email against {{report_query}}, classify the risk, and post a verdict with a recommended action to {{security_channel}}. Analyze and recommend only; never block, delete, or remediate.
Review the instructions the agent will receive before you install.
Search the phishing-report Gmail inbox with {{report_query}} for messages
reported since the last check. Read each one in full, including the original
message it wraps if it was forwarded — the reported wrapper email itself is
rarely the attack; the forwarded original is.
For the original (forwarded) message, inspect:
| Check | What to look for |
|---|---|
| SPF / DKIM / DMARC | Any result other than a clean pass on all three is a signal, not proof by itself |
| Reply-To vs. From | A Reply-To that doesn't match the From domain, especially to a free-mail or lookalike domain |
| Return-Path | A Return-Path domain unrelated to the claimed sender |
| Display name vs. address | A trusted display name ("IT Helpdesk") paired with an unrelated or misspelled address |
| Routing headers | Received chain hopping through unexpected countries or unrelated infrastructure for an internal-looking sender |
For every link in the body:
microsoft.com can point anywhere..pdf that's actually an executable or a macro-enabled
document is a strong signal.Combine the signals into one tier:
| Tier | Criteria |
|---|---|
| Critical | Credential-harvesting link or malicious attachment, spoofed authentication, actively impersonating an internal system or executive |
| High | Clear lookalike domain or header spoofing plus a suspicious link or attachment, but not yet confirmed credential harvesting |
| Medium | One or two suspicious indicators (e.g. authentication soft-fail plus an unusual link) without a clear malicious payload |
| Low | Minor anomalies (e.g. a marketing email with an aggressive tone) that don't indicate targeted attack |
| Benign | Clean authentication, legitimate sender and links, no attachment concerns — a false report |
Back every tier with the specific indicators found; don't assign a tier on tone or gut feel alone.
Write a short verdict: the tier, the indicators that drove it, and one recommended action:
Post the verdict to {{security_channel}}: tier, indicators, recommended action, and a link back to the reported thread. That post is the only output. There's no ledger to update — the next scheduled check re-reads whatever the inbox looks like then.
</workflow> <guardrails> - **Analyze, recommend, alert — nothing else.** The agent never blocks a sender, deletes or quarantines a message, or changes anything in Gmail or any other system. The recommended action is a suggestion for a person on security to carry out. - **No memory between runs.** Each check is a fresh session; the current inbox state is the only source of truth, not what a prior run concluded. - **Don't inflate the tier.** A report that's genuinely low-risk gets marked low-risk — a habit of crying wolf makes the real critical alerts easier to ignore. - **Scoped secrets.** Gmail access is brokered through a read-only connector; no raw token is ever shown to the model or written to logs. - **People decide, not the agent.** Whether a sender actually gets blocked or staff actually get warned is a human call on the security team, every time. </guardrails> </skill>No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Review Slack access requests against Okta role and team information, then prepare narrowly scoped GitHub or AWS IAM permissions. Apply changes only after an eligible person's approval and record the grant, reasoning, approver, and timestamp.
Research companies and people before outreach or meetings. Combines business profiles, recent news, hiring signals, and key contacts into a sourced brief with talking points and suggested questions, adding relationship history when CRM data is connected.
Review daily Google Ads and Meta Ads results for budget pacing, declining performance, and unusual activity. Get prioritized findings with supporting numbers and concrete recommendations for a marketing team to assess and carry out.
Automate website tasks such as navigating pages, filling forms, clicking buttons, taking screenshots, and extracting data. The skill also supports web app testing, with specialized guides for Electron desktop apps, Slack, and cloud browsers.
Process emailed vendor invoices by extracting details, comparing them with purchase orders and invoice history, and recording duplicates, overcharges, or missing orders. Summarize results in Slack for human review; payment approval and execution remain with people.
Guide changes to Kortix billing code, admin controls, and pricing screens. Explain how plans, trials, enterprise contracts, and access exceptions should work, where pricing is defined, and which audited routes must handle account changes.