The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is explicitly designed for credential harvesting. The associated script scripts/agent.py enables the capture of user passwords in its API requests to the GoPhish platform by setting capture_passwords to True.
[DATA_EXFILTRATION]: The Python script scripts/agent.py disables SSL certificate verification by default in the GoPhishClient class and during the creation of SMTP sending profiles. This configuration exposes sensitive data, including API keys and captured credentials, to potential man-in-the-middle (MitM) attacks.
[COMMAND_EXECUTION]: The SKILL.md instructions guide the user through the setup and execution of various offensive security frameworks such as GoPhish, Evilginx2, King Phisher, and the Social Engineering Toolkit (SET).
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests untrusted data (target email lists and GoPhish API responses) in scripts/agent.py and processes it for reporting without explicit sanitization, boundary markers, or delimiters.
[CREDENTIALS_UNSAFE]: The automation script scripts/agent.py requires the GoPhish API key to be passed as a command-line argument, which can result in the credential being exposed in shell history or system process logs.

executing-phishing-simulation-campaign