Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Youngmaidainon/Agent-Level-Up --skill conducting-phishing-incident-responsegit clone --depth 1 https://github.com/Youngmaidainon/Agent-Level-UpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/youngmaidainon/agent-level-up/conducting-phishing-incident-response)<a href="https://agentmods.dev/skills/youngmaidainon/agent-level-up/conducting-phishing-incident-response"><img src="https://agentmods.dev/badge/skills/youngmaidainon/agent-level-up/conducting-phishing-incident-response/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/youngmaidainon/agent-level-up/conducting-phishing-incident-response"><img src="https://agentmods.dev/badge/skills/youngmaidainon/agent-level-up/conducting-phishing-incident-response.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.02638 |
| Opus 5 | $0.00037 | $0.01319 |
| Sonnet 5 | $0.00015 | $0.00528 |
| Haiku 4.5 | $0.00007 | $0.00264 |
Grade A, and why
conducting-phishing-incident-response scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to conducting-phishing-incident-response — 41 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 283 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Conducting Phishing Incident Response
When to Use
- A user reports receiving a suspicious email via the phishing report button or abuse mailbox
- Email gateway detects a malicious email that bypassed initial filtering
- Threat intelligence indicates an active phishing campaign targeting the organization
- A user confirms they clicked a link or opened an attachment from a suspicious email
- Credentials have been entered on a suspected phishing page
Do not use for business email compromise (BEC) involving compromised internal accounts; use BEC response procedures which focus on account takeover investigation.
Prerequisites
- Email security gateway with message trace and quarantine capabilities (Microsoft Defender for Office 365, Proofpoint, Mimecast)
- Microsoft 365 admin access or Google Workspace admin for mailbox search and purge
- Malware sandbox for attachment and URL analysis (ANY.RUN, Joe Sandbox, Hybrid Analysis)
- Email header analysis tools (MXToolbox Header Analyzer, Google Admin Toolbox)
- Identity provider access for account remediation (Azure AD, Okta, Duo)
- Phishing report intake process (dedicated mailbox or integrated report button)
Workflow
Step 1: Receive and Triage the Phishing Report
Evaluate the reported email to determine if it is malicious:
- Extract the email as an .EML or .MSG file (preserves headers)
- Analyze email headers to determine the true sender, relay path, and authentication results
Email Header Analysis Checklist:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Return-Path: billing@spoofed-domain[.]com
From: "IT Support" <support@corp-lookalike[.]com>
Reply-To: attacker@gmail[.]com (different from From)
SPF: FAIL (sender IP not authorized for domain)
DKIM: FAIL (signature invalid)
DMARC: FAIL (policy: none - no enforcement)
Received: from mail.attacker-infra[.]net [45.33.x.x]
X-Originating-IP: 45.33.x.x
Message-ID: <[email protected]>
Classification criteria:
- Confirmed Phishing: Malicious URL/attachment, spoofed sender, credential harvesting page
- Suspicious: Anomalous headers but no confirmed malicious content
- Spam/Marketing: Unwanted but not malicious
- Legitimate: Not a phishing email (false report)
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 283 lines · 75 tokens per session scan A c5219567bb23
conducting-phishing-incident-response is a skill published in the GitHub repository Youngmaidainon/Agent-Level-Up (3 stars, last pushed 18d ago), licensed MIT. It adds 75 tokens to every session and 2,638 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. It is 88% identical to conducting-phishing-incident-response, differing in 41 lines, and is treated as a copy.
Other skills, from other repositories
conducting-phishing-incident-response
Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for…
conducting-phishing-incident-response
Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for…
playwright-cli
Automates browser interactions for testing and validating your own web applications using playwright-cli. Use when you need terminal-first browser control for navigation, form filling, screenshots, tracing, bound browser sessions, debugging, or generating Playwright test code. Only use against applications you own or…
update-llms
Updates the llms.txt file to reflect changes in documentation. Use when editing repository details or specifications. For creating from scratch, see create-llms.
competitor-analysis
Structured competitor teardown skill. Use when scraping competitor sites, extracting pricing/features/positioning, or analyzing strategic gaps. For general research, see market-research.
idea-validator
Structured validation framework that scores product ideas. Use when evaluating problem severity, willingness-to-pay, or founder-market fit. For market intelligence, see market-research.