Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tradecatlabs/vibe-coding-cn --skill conducting-phishing-incident-responsegit clone --depth 1 https://github.com/tradecatlabs/vibe-coding-cnWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tradecatlabs/vibe-coding-cn/conducting-phishing-incident-response)<a href="https://agentmods.dev/skills/tradecatlabs/vibe-coding-cn/conducting-phishing-incident-response"><img src="https://agentmods.dev/badge/skills/tradecatlabs/vibe-coding-cn/conducting-phishing-incident-response/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tradecatlabs/vibe-coding-cn/conducting-phishing-incident-response"><img src="https://agentmods.dev/badge/skills/tradecatlabs/vibe-coding-cn/conducting-phishing-incident-response.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.02638 |
| Opus 5 | $0.00037 | $0.01319 |
| Sonnet 5 | $0.00015 | $0.00528 |
| Haiku 4.5 | $0.00007 | $0.00264 |
Grade A, and why
conducting-phishing-incident-response scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 283 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Conducting Phishing Incident Response
When to Use
- A user reports receiving a suspicious email via the phishing report button or abuse mailbox
- Email gateway detects a malicious email that bypassed initial filtering
- Threat intelligence indicates an active phishing campaign targeting the organization
- A user confirms they clicked a link or opened an attachment from a suspicious email
- Credentials have been entered on a suspected phishing page
Do not use for business email compromise (BEC) involving compromised internal accounts; use BEC response procedures which focus on account takeover investigation.
Prerequisites
- Email security gateway with message trace and quarantine capabilities (Microsoft Defender for Office 365, Proofpoint, Mimecast)
- Microsoft 365 admin access or Google Workspace admin for mailbox search and purge
- Malware sandbox for attachment and URL analysis (ANY.RUN, Joe Sandbox, Hybrid Analysis)
- Email header analysis tools (MXToolbox Header Analyzer, Google Admin Toolbox)
- Identity provider access for account remediation (Azure AD, Okta, Duo)
- Phishing report intake process (dedicated mailbox or integrated report button)
Workflow
Step 1: Receive and Triage the Phishing Report
Evaluate the reported email to determine if it is malicious:
- Extract the email as an .EML or .MSG file (preserves headers)
- Analyze email headers to determine the true sender, relay path, and authentication results
Email Header Analysis Checklist:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Return-Path: billing@spoofed-domain[.]com
From: "IT Support" <support@corp-lookalike[.]com>
Reply-To: attacker@gmail[.]com (different from From)
SPF: FAIL (sender IP not authorized for domain)
DKIM: FAIL (signature invalid)
DMARC: FAIL (policy: none - no enforcement)
Received: from mail.attacker-infra[.]net [45.33.x.x]
X-Originating-IP: 45.33.x.x
Message-ID: <[email protected]>
Classification criteria:
- Confirmed Phishing: Malicious URL/attachment, spoofed sender, credential harvesting page
- Suspicious: Anomalous headers but no confirmed malicious content
- Spam/Marketing: Unwanted but not malicious
- Legitimate: Not a phishing email (false report)
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 283 lines · 75 tokens per session scan A c5219567bb23
conducting-phishing-incident-response is a skill published in the GitHub repository tradecatlabs/vibe-coding-cn (16,181 stars, last pushed today), licensed MIT. It adds 75 tokens to every session and 2,638 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-13.
Other skills, from other repositories
conducting-phishing-incident-response
Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for…
conducting-phishing-incident-response
Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected…
conducting-phishing-incident-response
Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for…
self-awareness-review
Reviews a given week of your OWN Teams meetings, chats, and sent emails to surface moments where you may have misread social signals or come across as passive-aggressive, curt, sarcastic, or dismissive — returning the exact quote, how it likely landed, and a kinder rewrite. Private self-reflection coaching for the…
weekly-pacing
Analyzes the user's upcoming or current work week using Work IQ signals (calendar, email volume, and semantic themes) and produces a visualized pacing report — classifying each day as Rest, Light, Focus, or Heavy based on meeting load, back-to-back density, communication volume, and available deep-work time. Designed…
give-ai-direct-feedback
Give specific feedback about what is wrong, what should change, and which parts should remain.