respond-phishing

Respond to a reported phishing email following PICERL methodology. Use when a phishing email is reported or detected. Analyzes artifacts, identifies recipients who clicked, contains malicious IOCs, and removes emails from mailboxes.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/respond-phishing/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured PICERL phishing workflow with clear phasing and concrete tool calls, but it mixes executable guidance with placeholders and lacks explicit validation feedback loops for its destructive batch operations. Splitting reference material into bundle files and tightening duplication would raise the score.

Suggestions

Add explicit validation feedback loops for destructive/batch steps (e.g., verify email-deletion counts and confirm blocks before proceeding) so workflow_clarity can exceed 3.

Replace placeholders like 'Requires Email Gateway/Platform tools' and the MALICIOUS_IOCs search pseudocode with concrete, executable commands to lift actionability.

Move the phishing-category table and required-outputs reference into a separate references/ file and link from the body to improve progressive_disclosure and reduce duplication.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and assumes competence, but some sections restate obvious context (e.g., 'After completing each phase, you MUST report these outputs') and the required-outputs tables duplicate names used later; minor trimming possible.	4 / 5
Actionability	Mix of concrete tool calls (secops-soar.get_case_full_details, /enrich-ioc) and pseudocode placeholders (text="Network connections or DNS to MALICIOUS_IOCs", 'Requires Email Gateway/Platform tools' without specifics); key execution details missing.	3 / 5
Workflow Clarity	Phases and steps are well sequenced with /confirm-action confirmations, but destructive/batch operations (delete emails from ALL mailboxes, block IOCs) lack explicit validate-then-proceed feedback loops, capping the score at 3 per the destructive-operations guideline.	3 / 5
Progressive Disclosure	Well-organized single-file structure with clear sections, but no bundle files exist and the inline category tables and required-outputs could be separate references; some content that could be split is inlined.	3 / 5
	Total	13 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states both purpose and trigger, with multiple concrete actions and a distinct niche. Minor gains possible by adding common synonyms like 'suspicious email' and enumerating a few more actions.

Dimension	Reasoning	Score
Specificity	Names the domain and multiple concrete actions ('analyzes artifacts, identifies recipients who clicked, contains malicious IOCs, and removes emails from mailboxes'); minor gaps in coverage keep it just short of comprehensive.	4 / 5
Completeness	Explicitly states both what (PICERL methodology workflow with concrete actions) and when ('Use when a phishing email is reported or detected') with a concrete trigger phrase.	5 / 5
Trigger Term Quality	Good natural coverage with 'phishing email is reported or detected' plus 'phishing', but misses common variations a user might say ('suspicious email', 'phish report'); a few natural terms absent.	4 / 5
Distinctiveness Conflict Risk	Clear narrow niche (reported phishing response) with distinct triggers; minimal overlap risk with unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/respond-phishing/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.