The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Instructions in SKILL.md describe downloading a binary file from a third-party GitHub repository (gophish/gophish), granting it execution permissions (chmod +x), and running it directly. Executing binaries from untrusted sources is a significant security risk.
[DATA_EXFILTRATION]: The agent.py and process.py scripts include logic to disable SSL/TLS certificate verification via the SKIP_TLS_VERIFY environment variable or --no-verify-ssl CLI flag. This behavior risks exposing the GoPhish API key to interception through man-in-the-middle attacks during network operations.
[METADATA_POISONING]: The skill metadata in SKILL.md lists the author as 'mahipal', which contradicts the copyright holder 'mukul975' specified in the LICENSE file and system context.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting untrusted external data. 1. Ingestion points: scripts/process.py reads target user data from local CSV files; scripts/agent.py fetches campaign data from a remote API. 2. Boundary markers: Absent. 3. Capability inventory: The skill has network capabilities (API access) and file write access (report generation). 4. Sanitization: Absent. The scripts incorporate raw strings from CSV and API data into logic and reports without validation or filtering.

performing-phishing-simulation-with-gophish