When someone reports a suspicious message in Slack, assesses it for phishing indicators, replies in thread and logs it.
Uses
Claude
Google Sheets
Slack
Triage reported phishing in Slack
SlackWhen someone posts in a channel. Save it as report.When someone posts in a channel. Save it as report.
Set logSheetUrl to blank.Set logSheetUrl to blank.Set logTab to Reports.Set logTab to Reports.
Trim report.text and save it as reportText.Trim report.text and save it as reportText.
If reportText is emptyIf reportText is emptyYes
Finish the run: The report had no text to assess, so nothing was done.Finish the run: The report had no text to assess, so nothing was done.No
No steps
ClaudeAsk Claude: 'You are doing a FIRST-PASS triage of a message someone reported as suspicious. You are not the final word and must not say anything is definitely safe.Ask Claude: 'You are doing a FIRST-PASS triage of a message someone reported as suspicious. You are not the final word and must not say anything is definitely safe.
Reply in exactly this shape:
RISK: one of HIGH, MEDIUM, LOW
WHY: one sentence naming the specific indicators you saw
DO: one sentence telling the reporter what to do next
Judge on observable indicators only - sender mismatch, lookalike domains, urgency or threat language, credential or payment requests, mismatched or shortened links, unexpected attachments. If there is not enough to go on, say so and use MEDIUM rather than guessing LOW.
The reported message:
reportText'. Save it as assessment.
Maximum response length: 300Trim assessment.response_text and save it as verdict.Trim assessment.response_text and save it as verdict.SlackReply in a thread in report.channel_id.Reply in a thread in report.channel_id.
Reply To: report.message_ts*Automated first-pass triage*
verdict
_This is an automated assessment, not a final determination. If in doubt, treat it as suspicious and escalate._Google SheetsAdd a row to logTab in logSheetUrl.Add a row to logTab in logSheetUrl.