Introduction

In daily operations and security collaboration, colleagues often send screenshots of emails asking “Is this phishing?” or SMS messages containing short links. Relying solely on a few memorized rules is hard to cover combinations like sender spoofing, look-alike domains, and urgency tactics. By writing identification steps, checklists, and remediation actions into an Agent-ready Skill, you can perform feature checks, link judgment, and follow-up guidance using a consistent process within conversations. Below is an introduction to the community Skill “Phishing Identification Training” on SkillHub.

What is this

“Phishing Identification Training” is an Agent Skill designed for learning to identify phishing emails, SMS, and websites: it is enabled when users need to understand common phishing characteristics, link detection strategies, and reporting channels. Its coordinates are @user_70c2f807/phishing-identification, version 1.0.0, source community, category it-ops-security, and publisher user_70c2f807. The SkillHub page marks requires_api_key=false, meaning installation and usage do not rely on additional API Keys.

Official Entrances:

  • SkillHub Display Page: https://www.skillhub.cn/skills/user_70c2f807/phishing-identification
  • API Coordinates Page: https://api.skillhub.cn/user_70c2f807/phishing-identification

Core Features

The following content is derived from the Skill’s SKILL.md description and only summarizes the explicitly stated capabilities.

  1. Feature Analysis: Judges whether an email or SMS is suspicious by checking dimensions such as sender, body content, links, and attachments.
  2. Link Detection: Emphasizes not clicking directly; instead, verify URL authenticity and domain spoofing (e.g., character substitution, prefixes/suffixes) first.
  3. Scenario Training: Supports simulation and identification exercises for common phishing scenarios.
  4. Remediation: Provides emergency steps for when a link has been clicked or information has been leaked (password changes, account checks, 2FA, contacting institutions, etc.).
  5. Habits & Configuration: Ideas for email security filtering rules, daily anti-phishing habits, and outputting a structured “Analysis Checklist”.

The Skill explicitly does not provide methods for creating phishing attacks; it also notes that tactics evolve, AI-generated impersonation content is becoming more realistic, identification capabilities require continuous training, and enterprise-level protection still requires professional security teams.

Installation and Activation

Installation follows the official SkillHub instructions: first read https://skillhub.cn/install/skillhub.md, then install the skill to the specific skills directory actually read by the current Agent (the documentation emphasizes using --dir, otherwise the default ./skills/ might not be recognized).

1. Check or install the skillhub CLI

command -v skillhub && skillhub --version

If not installed, you can execute the full installation or just the CLI according to the installation documentation:

curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash

curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only

2. Install this Skill

The installation prompt provided by the SkillHub page is: According to the installation documentation above, install @user_70c2f807/phishing-identification.

When searching via CLI, the recommended command format includes the namespace (replace <skills directory> with the path in your current environment):

skillhub install phishing-identification --namespace user_70c2f807 --dir <skills 目录>

Common client skills directories (excerpted from SkillHub installation docs):

  • Cursor: ~/.cursor/skills/
  • Claude Code: ~/.claude/skills/
  • Codex: ~/.codex/skills/ or .agents/skills/ under the project

After installation is complete, restart or refresh the Agent according to your client’s requirements to load the new Skill.

Typical Usage

The “Quick Start” section within the Skill provides conversation entry points and an information gathering sequence, which can be reproduced as follows:

  1. In the conversation, state that you want to use “Phishing Identification Training,” or directly describe the suspicious content.
  2. Provide: The original text or screenshot description of the email/SMS/link, sender information and the actions they requested you to perform, and whether a link has been clicked or sensitive information entered.
  3. The Agent proceeds according to the execution steps in the Skill: Feature recognition → Link detection (verify before clicking) → Official channel verification → Avoid entering info on suspicious pages → Report → Remediation if necessary.

On the output side, the Skill stipulates a “Phishing Identification Analysis” structure, including a suspicious feature checklist, link security detection explanation, conclusion (Highly Suspicious / Needs Further Verification / Relatively Normal), and an emergency action list if compromised. Principles include “don’t click if uncertain,” prioritize checking domains, and remain skeptical of requests for passwords or verification codes.

The FAQ also organizes quick link judgment (hover to see URL, domain spelling, protocol meaning, using tools like VirusTotal, prioritizing official Apps), common phishing scenario types, and explanations of reporting channels like 12321 and the Anti-Fraud Center App. All are written in the Skill body and referenced by the Agent as needed during conversation.

Scenarios and Notes

Who it is for

  • Individuals or small teams needing to solidify scattered experience into checklists.
  • Users conducting phishing identification coaching and self-test training in clients supporting Skills, such as Cursor, Claude Code, and Codex.

Limitations and Pitfalls

  • The Skill states it cannot cover all new types of attacks; high-fidelity content still requires verification via official channels.
  • Not applicable for: Enterprise security awareness training design, phishing tracing, anti-phishing product development, social engineering in penetration testing, etc. (listed in the Skill’s “Not Applicable Scenarios” section).
  • Common misuses include: Looking only at the word “Official,” trusting accounts of acquaintances who have been hacked, assuming HTTPS means safe, and not checking senders and links.
  • SkillHub Metadata (at time of scraping): Rating 100000, Downloads 989, Installs 0; for community Skills, it is recommended to independently confirm if there are updates to the version and instructions on the SkillHub page before use.

Conclusion

“Phishing Identification Training” turns phishing identification from a slogan into a repeatable conversational process: feature checklists, link verification, judgment grading, and remediation are all written in SKILL.md for the Agent to execute. To enable it in a local Agent, start with the SkillHub installation documentation and install @user_70c2f807/phishing-identification into the corresponding skills directory. See details at: https://www.skillhub.cn/skills/user_70c2f807/phishing-identification