executing-phishing-simulation-campaign

SUSPICIOUS: the skill is internally consistent with its stated phishing-simulation purpose, but that purpose itself gives the agent high-risk offensive capabilities: sending phishing emails, harvesting credentials, capturing tokens, and potentially testing access against real systems. The main issue is not deception about purpose but the breadth and real-world impact of the enabled actions, which make this an unsafe AI-agent skill.

The material documents a dual-use phishing simulation agent with explicit credential-capture and campaign-launch capabilities. It is not itself executable malware, but it presents a high operational abuse risk if deployed against unauthorized targets. The documented default of verify_ssl=False is a notable security concern. No direct evidence of malicious package behavior or obfuscation is present in the supplied documentation.

The code provides legitimate GoPhish campaign-management functionality but includes inherently sensitive phishing capabilities, especially credential/password capture and campaign launching. It does not show independent malware behavior or covert exfiltration; network communication is directed to the user-supplied GoPhish server. Disabling TLS verification and ignoring SMTP certificate errors are significant security weaknesses. Use should be restricted to authorized simulations, with credential capture disabled where unnecessary and certificate verification enabled.