The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/agent.py processes high-value credentials, including a GoPhish API key and SMTP server passwords. These credentials are provided as plaintext command-line arguments and handled as in-memory variables.
[COMMAND_EXECUTION]: The agent script performs network operations using the requests library to user-specified URLs. The GoPhishClient class defaults to verify_ssl=False, which disables SSL certificate validation for all API interactions, creating a vulnerability to interception.
[DATA_EXFILTRATION]: The create_sending_profile method transmits plaintext SMTP credentials to the remote GoPhish server. If the server URL is malicious or compromised, these credentials will be exfiltrated to an unauthorized party.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of target email lists in scripts/agent.py. Ingestion points include email, name, and position fields. Boundary markers are absent. The capability inventory includes network POST operations to the GoPhish API server. No sanitization or validation is applied to the input data before interpolation, creating a vulnerability surface for schema confusion or tool output poisoning.

executing-phishing-simulation-campaign