What do I need to use Phishing Triage?

The message; The channel; The ask; Context; Did you act.

Is Phishing Triage free to use?

Yes — run it free in the browser playground (no API key needed for the sponsored trial, or bring any provider key), or install it into Claude Code, Cursor, ChatGPT and more via npx pm-claude-skills. MIT-licensed and open source.

Phishing Triage

Q: How do I know the Phishing Triage output is good?

The skill verifies itself against its own quality checks: Gives a clear verdict with confidence; Cites the specific red/green flags in the actual message; Verification uses independent official channels, never the message's links; Tells the user exactly what to do next.

🔵 Stable🕐 updated 2026-08-05 🔷 SkillSpec L3 pm-digital-safety

Decide fast whether a suspicious message is a phishing scam — and what to do next — without clicking anything. Use when asked is this email/text a scam, is this message legit, I got a suspicious message, or did I just get phished. Produces a quick verdict with the specific red (and green) flags in the message, a safe way to verify through official channels, exactly what to do next (delete/report, or act if genuine), and recovery steps if you already clicked or entered details.

▶ Run it free — no key needed 📝 Grade your existing draft View SKILL.md ↗

🗣 Say this to your agent

“Is this text from my bank real? It says my account is locked.”“I got an email asking me to confirm my password — is it a scam?”“Someone messaged me a link about a package fee. Legit?”“I think I just got phished — I clicked the link and logged in.”“Did I just get scammed? They asked for a one-time code.”

What to give it

▸The message — the text/email content, sender address, and any link (as text — don't click)

▸The channel — email, SMS, DM, call, QR code

▸The ask — what it wants (click, log in, pay, share a code, download)

▸Context — were you expecting it; do you have an account with the claimed sender

▸Did you act — clicked, entered credentials, paid, or shared a code

✅ The bar it holds itself to

Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.

✓Gives a clear verdict with confidence

✓Cites the specific red/green flags in the actual message

✓Verification uses independent official channels, never the message's links

✓Tells the user exactly what to do next

✓Includes recovery steps for those who already clicked/entered details

✓Never instructs the user to click the suspicious link

⚠️ What it refuses to do

**A vague "be careful"** with no verdict or specific flags.

**Telling them to click the link** to "check."

**Trusting the display name** over the real address/domain.

**Using the phone number/link in the message** to "verify."

**No recovery path** for someone who already fell for it.

Install

npx pm-claude-skills add --agent claude   # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y pm-claude-skills-mcp

Related skills

🔌 Embed this skill

Drop this on your blog, docs, or site — it renders a "Run this skill" card:

<div data-pm-skill="phishing-triage"></div>
<script src="https://mohitagw15856.github.io/pm-claude-skills/embed.js" async></script>

💬 Discussion

Phishing Triage is one of 1153 open-source professional AI agent skills — all SkillSpec L3. Try them all in the browser · ⭐ Star on GitHub · Browse the full catalog