phishing-triage

Phishing Triage

Phishing works by manufacturing urgency so you act before you think. This does the thinking: it reads the specific signals in the message — the sender, the link, the pressure, the ask — gives a clear verdict, and tells you how to verify safely (by going to the source yourself, never via the message). And if you already clicked or entered details, it switches straight to damage control.

What This Skill Produces

• A verdict — likely phishing / likely legit / unsure, with confidence
• The specific flags — the red flags present (mismatched sender, look-alike link, urgency, unusual ask, generic greeting) and any reassuring green flags
• The safe verify step — how to confirm by contacting the company through official channels you look up yourself
• What to do next — delete and report if phishing; the safe way to act if it's genuine
• Already clicked? — the immediate recovery steps (change password, enable 2FA, watch for fraud, run a scan)

Required Inputs

Ask for these if not provided:

• The message — the text/email content, sender address, and any link (as text — don't click)
• The channel — email, SMS, DM, call, QR code
• The ask — what it wants (click, log in, pay, share a code, download)
• Context — were you expecting it; do you have an account with the claimed sender
• Did you act — clicked, entered credentials, paid, or shared a code

Framework: Read The Signals, Verify At Source

1. Check the sender and the link, not the display name. Look at the real address/domain and where a link actually points (hover/long-press) — look-alikes and mismatches are the tell.
2. Weigh the pressure and the ask. Urgency ("act now or lose access"), threats, unexpected attachments, requests for passwords/codes/payment, or gift-card asks are classic phishing.
3. Verify independently. Never use the message's links or numbers — go to the company's official site/app or a number from your card/statement and check there.
4. Match the pattern. Too-good offers, "confirm your details," delivery-fee scams, "your account is suspended," and one-time-code requests are common templates.
5. If in doubt, don't act — verify or delete. The safe default is to not click and to confirm through a channel you trust.
6. If already caught, pivot to recovery immediately — speed limits the damage.

Output Format

Message triage: [channel] · asks you to [action]

Verdict: [likely phishing / likely legit / unsure] — [confidence].

Red flags: [sender/domain · link mismatch · urgency · unusual ask · greeting …].

Green flags (if any): [expected · matches official domain …].

Verify safely: go to [official site/app or number from your card] — not the message's links.

Do this: [delete + report as phishing] · or [the safe way to act if genuine].

If you already clicked / entered details

• Change that password (and anywhere reused) + enable 2FA · watch for fraud / contact your bank if payment or card details · run a security scan · report it.

Quality Checks

• [ ] Gives a clear verdict with confidence
• [ ] Cites the specific red/green flags in the actual message
• [ ] Verification uses independent official channels, never the message's links
• [ ] Tells the user exactly what to do next
• [ ] Includes recovery steps for those who already clicked/entered details
• [ ] Never instructs the user to click the suspicious link

Anti-Patterns

• A vague "be careful" with no verdict or specific flags.
• Telling them to click the link to "check."
• Trusting the display name over the real address/domain.
• Using the phone number/link in the message to "verify."
• No recovery path for someone who already fell for it.

Example Trigger Phrases

• "Is this text from my bank real? It says my account is locked."
• "I got an email asking me to confirm my password — is it a scam?"
• "Someone messaged me a link about a package fee. Legit?"
• "I think I just got phished — I clicked the link and logged in."
• "Did I just get scammed? They asked for a one-time code."