executing-phishing-simulation-campaign
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions define a structured workflow for phishing simulations, explicitly requiring written authorization and limiting activities to authorized scopes. It identifies itself as a penetration testing tool and includes warnings against sending emails that could cause psychological harm or legal liability.
- [SAFE]: The included automation script (
scripts/agent.py) is a transparent wrapper for the GoPhish API. It manages campaign lifecycle tasks such as creating templates, importing targets, and fetching metrics. All external interactions are restricted to the user-provided GoPhish server URL via standard HTTPS requests using therequestslibrary. - [INDIRECT_PROMPT_INJECTION]: The skill ingests campaign result data from a remote GoPhish API server to generate reports, creating a surface for indirect prompt injection. Data enters the context in
scripts/agent.pythrough theget_campaign_resultsmethod. No explicit boundary markers or sanitization steps are present beyond standard JSON parsing. However, the risk is negligible as the ingested data is used solely for calculating statistical metrics and generating local JSON reports.
Audit Metadata